JP5985094B1 - Information providing apparatus, information providing method, and computer program - Google Patents

Abstract

The convenience of browsing a log recorded by an operation management apparatus is improved without impairing information security. An information providing apparatus 22 is installed in a neutral NW 16 different from a first operation NW 28a in which a first operation management apparatus 30a is installed. The information providing apparatus 22 acquires a log indicating the operation state of the first management target system 32a from the first operation management apparatus 30a. When the information providing apparatus 22 receives a log viewing request from the PC 12a installed in the first development NW 10a that is prohibited from accessing the first operation NW 28a, the information providing apparatus 22 stores the log acquired from the first operation management apparatus 30a. Information to be shown is provided to the PC 12a. [Selection] Figure 1

Description

  The present invention relates to a data processing technique, and more particularly to an information providing apparatus, an information providing method, and a computer program.

  An operating information system may be provided with an operation management apparatus for supporting the operation of the system. The operation management apparatus may record the operation status of each apparatus in the management target system in a log. Further, execution of jobs such as batch processing in the management target system may be managed (see, for example, Patent Documents 1 and 2).

JP 9-274596 A JP 2012-48331 A

  When a failure occurs in the information system, the person in charge of the ICT service company may check a log indicating the operation status of the information system recorded by the operation management apparatus. Currently, it is required to secure information security, and the person in charge needs to obtain the log by operating the dedicated terminal connected to the operation management device after entering the production terminal room with the permission of the supervisor. In some cases, the operator of the data center in which the operation management apparatus is installed is contacted to request the operator to obtain a log. As a result, it takes a long time to deal with the failure of the information system, and for example, it may take 30 minutes or more to acquire a log.

  The present invention has been made in view of the above problems, and a main object thereof is to improve the convenience of browsing logs recorded by the operation management apparatus without impairing information security.

  In order to solve the above problems, an information providing apparatus according to an aspect of the present invention is an information providing apparatus provided independently of an operation management apparatus that manages the operation of a predetermined information system. When a log acquisition unit that acquires a log indicating the operation status of the recorded information system from the operation management device and a log viewing request from a user terminal that is prohibited from accessing the operation management device, the log acquisition unit A log information providing unit that provides information indicated by the acquired log to a user terminal.

  Another aspect of the present invention is an information providing method. In this method, a computer provided independently of an operation management apparatus that manages the operation of a predetermined information system acquires a log indicating an operation state of the information system recorded by the operation management apparatus from the operation management apparatus. And a step of providing information indicated by the log acquired in the acquiring step to the user terminal when a log browsing request is received from the terminal of the user who is prohibited from accessing the operation management apparatus.

  It should be noted that any combination of the above components and the expression of the present invention converted between a system, a computer program, a recording medium storing the computer program, and the like are also effective as an aspect of the present invention.

  ADVANTAGE OF THE INVENTION According to this invention, the convenience of browsing of the log recorded by the operation management apparatus can be improved, without impairing information security.

It is a figure which shows the structure of the enterprise system of embodiment. It is a block diagram which shows the function structure of the 1st log collection server of FIG. It is a block diagram which shows the function structure of the portal server of FIG. It is a figure which shows the example of a job confirmation screen. It is a figure which shows the example of a job filter setting screen. It is a figure which shows the example of a log search screen. It is a figure which shows the example of a search filter setting screen.

  FIG. 1 shows a configuration of a company system 1 according to the embodiment. The enterprise system 1 is an information processing system constructed by an ICT service enterprise (system integrator or the like). An ICT service company provides an outsourcing service for information system management to a customer, and specifically, operates an information system of a plurality of customers at its own data center.

  In the data center, a first operation NW 28a, a second operation NW 28b, and a neutral NW 16 that are networks (LAN, WAN, etc.) managed by the operation department of the ICT service company are constructed. These networks are at least different broadcast domains. In the present embodiment, the network is separated by the router 14, the router 24, and the router 26 having a packet filtering function. However, the network may be separated by other types of communication devices such as a switch.

  In FIG. 1, a first management target system 32a, which is an information system that executes information processing for a first customer, is constructed in the first operation NW 28a. The first operation management device 30a is installed in the first operation NW 28a, and the first operation management device 30a manages the operation of a plurality of management target devices (such as various business servers) constituting the first management target system 32a. . For example, the operating state (in other words, the operating status) of each managed device is monitored, and the execution of jobs such as batch processing is managed.

  The first operation management apparatus 30a records a log (hereinafter also referred to as “message log”) indicating an operation state of the first management target system 32a (or a plurality of management target apparatuses included in the first management target system 32a). . The first operation management device 30a records a message log for one day in one log file and holds the log file for one week. That is, the message logs for the current day and the past six days are retained, and the previous message logs are deleted.

  The message log according to the embodiment includes a message ID, a node ID / node name / status flag (normal or abnormal) of the target node indicating the status, a message log source (operation management device name, etc.), and a recording date and time. The message log related to the job execution status further includes a frame name, a net name, a job name, a job status (startup, normal end, abnormal end, etc.), and job execution date and time. A job defines one unit of processing (batch processing or the like). A net is also called a job net, and defines a combination of a plurality of jobs (execution order, dependency, etc.). A frame defines a combination of multiple nets.

  In FIG. 1, a second managed system 32b, which is an information system for executing information processing for a second customer, is constructed in the second operation NW 28b. The second operation management device 30b is installed in the second operation NW 28b, and the second operation management device 30b manages the operation of a plurality of management target devices constituting the second management target system 32b. Similar to the first operation management apparatus 30a, the second operation management apparatus 30b records a message log indicating the operation state of the second management target system 32b (or a plurality of management target apparatuses included in the second management target system 32b). . The second operation management apparatus 30b records a message log for one day in one log file and holds the log file for one week.

  Known operation management manager software is installed in the first operation management apparatus 30a and the second operation management apparatus 30b, and an operation management manager process (function) is activated. Also, known operation management agent software is installed in each device constituting the first managed system 32a and the second managed system 32b, and an operation management agent process (function) is started. The above message log is generated by the manager process of operation management and is sequentially recorded in the log file of the day.

  In the data center, a neutral NW 16 separated from the first operational NW 28a by the router 24 and separated from the second operational NW 28b by the router 26 is constructed. The neutral NW 16 is provided with a portal server 18, a first log collection server 20a, and a second log collection server 20b. In the embodiment, a log collection server is provided on a one-to-one basis with an operation management apparatus (in other words, a management target system). Detailed functions of the portal server 18, the first log collection server 20a, and the second log collection server 20b will be described later.

  Although not shown in FIG. 1, a third operation NW may be constructed in the data center, and a third managed system that executes information processing for a third customer may be constructed in the third operation NW. Further, a third operation management device may be installed in the third operation NW, and the third operation management device may manage the operation of each device constituting the third management target system. In this case, the neutral NW 16 is further provided with a third log collection server corresponding to the third operation management device (third management target system).

  A first development NW 10a and a second development NW 10b are provided at a development base of an ICT service company (for example, an office building geographically separated from a data center). The first development NW 10a is a network managed by the first development department of the ICT service company, and is connected to a PC and a communication device managed by the first development department. The second development NW 10b is a network managed by the second development department of the ICT service company, and is connected to a PC and a communication device managed by the second development department.

  For example, the first development NW 10a is a LAN in a room where a person in charge of the first development department carries out development work, and a PC 12a used by the person in charge of the first development department in the development work is installed. The first development department is responsible for maintenance (failure handling, customer handling, etc.) of the managed system 32a, and the person in charge of the first development department needs to refer to the message log of the first operation management apparatus 30a.

  The second development NW 10b is a LAN in a room where a person in charge of the second development department performs development work, and a PC 12b used by the person in charge of the second development department in the development work is installed. The second development department is responsible for maintenance (failure handling, customer handling, etc.) of the managed system 32b, and the person in charge of the second development department needs to refer to the message log of the second operation management apparatus 30b.

  The first development NW 10 a and the second development NW 10 b are separated from the data center network by the router 14. It is prohibited for the devices in the first development NW 10a and the second development NW 10b to directly access the devices in the first operation NW 28a and the second operation NW 28b. The router 14 discards the packet addressed to the device (for example, the first operation management device 30a) in the first operation NW 28a transmitted from the device (for example, the PC 12a) in the first development NW 10a without passing it. Similarly, the router 14 discards the packet addressed to the device (for example, the second operation management device 30b) in the second operation NW 28b transmitted from the device (for example, the PC 12b) in the second development NW 10b without passing it.

  The router 14 according to the embodiment passes only an HTTP request having the portal server 18 as a transmission destination among packets having a transmission source of a device (for example, the PC 12a) in the first development NW 10a by a known packet filtering function. Similarly, the router 14 passes only an HTTP request whose destination is the portal server 18 among packets whose source is an apparatus (for example, the PC 12b) in the second development NW 10b.

  As described in part, it took a long time to check the message logs of the first operation management device 30a and the second operation management device 30b on the development department side. For example, the person in charge of the first development department who has received the notification of the occurrence of a failure in the first managed system 32a enters the production terminal room provided at the development base with the permission of the superior, and the first managed system It is necessary to obtain a log by operating a special information terminal (hereinafter also referred to as “production terminal”) configured to be able to access the terminal 32a (first operation management apparatus 30a).

  In this case, typically, the message log of the first operation management device 30a acquired at the production terminal is stored in the USB memory, the USB memory is taken back to the room, inserted into the PC 12a, and the message log is confirmed by the PC 12a. It was. Alternatively, the operator of the data center is requested to collect the message log of the first operation management apparatus 30a, and the message log provided by the operator is confirmed on the PC 12a. Therefore, it may take 30 minutes or more to start checking the message log, and it may be difficult to quickly deal with a failure.

  In the corporate system 1 according to the embodiment, the information providing apparatus 22 is realized by the cooperation of the portal server 18, the first log collection server 20 a, and the second log collection server 20 b installed in the neutral NW 16. When the third log collection server is installed in the neutral NW 16, the third log collection server further cooperates to realize the information providing apparatus 22. It should be noted that the functions of the portal server 18, the first log collection server 20a, and the second log collection server 20b are physically integrated into one casing, and one information providing device 22 is physically constructed. Of course it is good.

  Specifically, the information providing device 22 acquires and accumulates the message log recorded by the first operation management device 30a from the first operation management device 30a, and stores the message log recorded by the second operation management device 30b. Acquired from the second operation management device 30b and accumulated. When receiving a message log browsing request from the PC 12a, the information providing device 22 provides the PC 12a with information indicated by the message log acquired and accumulated from the first operation management device 30a. Further, when a message log browsing request is received from the PC 12b, the information indicated by the message log acquired and accumulated from the second operation management apparatus 30b is provided to the PC 12b.

  The person in charge of the first development department (second development department) starts a web browser on the PC 12a (PC 12b) and accesses the operation portal site of the portal server 18 via the web browser. The web browser of the PC 12a (PC 12b) displays a log browsing screen provided by the operation portal site. The person in charge of the first development department (second development department) looks at the log browsing screen and confirms the message log output by the first operation management apparatus 30a (second operation management apparatus 30b).

  According to the information providing device 22, while maintaining the prohibition of direct access from the development department network to the production environment network, the person in charge of the development department can refer to the message log output by the operation management apparatus on his / her own PC. You can also get it. As a result, the operating state of the monitored system can be quickly grasped. That is, according to the information providing apparatus 22, it is possible to support shortening of the initial operation time and speeding up of work in dealing with a failure without impairing information security of the enterprise system 1.

  Next, the structure of the portal server 18, the 1st log collection server 20a, and the 2nd log collection server 20b for implement | achieving the information provision apparatus 22 is demonstrated.

  FIG. 2 is a block diagram showing a functional configuration of the first log collection server 20a of FIG. The first log collection server 20 a includes a control unit 40, a storage unit 42, and a communication unit 44. The control unit 40 executes various data processing for collecting and accumulating logs, and the storage unit 42 is a storage area for storing data that is referred to and updated by the control unit 40. The communication unit 44 communicates with an external device according to a predetermined communication protocol. The control unit 40 transmits / receives data to / from the portal server 18 and the first operation management device 30a via the communication unit 44.

  Each block shown in the block diagram of the present specification can be realized in terms of hardware by an element such as a CPU of a computer or a mechanical device, and in terms of software, it can be realized by a computer program or the like. The functional block realized by those cooperation is drawn. Therefore, those skilled in the art will understand that these functional blocks can be realized in various forms by a combination of hardware and software.

  For example, a log collection application program including a plurality of modules corresponding to a plurality of functional blocks in the control unit 40 may be stored in a recording medium such as a DVD and installed in the storage of the first log collection server 20a. The CPU of the first log collection server 20a may exhibit the function of each functional block by reading the log collection application program stored in the storage into the main memory and executing it. The storage unit 42 may be realized by storing data in the storage or memory of the first log collection server 20a. The same applies to the portal server 18 described later with reference to FIG.

  The storage unit 42 includes a log storage unit 46 and a log acquisition status holding unit 48. The control unit 40 includes a log acquisition unit 50, a log recording unit 52, a log providing unit 54, and a log deletion unit 56.

  The log storage unit 46 stores a message log acquired from the first operation management apparatus 30a. The log storage unit 46 stores the message log for a period longer than the period (one week) in which the first operation management apparatus 30a holds the message log, specifically for one year. The log acquisition status holding unit 48 stores a message log acquisition status. Specifically, information indicating whether the message log acquisition status is normal or abnormal, and information indicating the latest acquisition date and time are stored. As will be described later, the message log search by the portal server 18 targets the message logs for the past year accumulated in the log accumulation unit 46.

  Regardless of the frequency (traffic) of log browsing requests from the PC 12a to the portal server 18, the log acquisition unit 50 periodically acquires message logs from the first operation management device 30a at a predetermined frequency. In the first operation management apparatus 30a, an SSH daemon may be activated, and the log acquisition unit 50 may acquire a message log using SCP or SFTP.

  In the embodiment, the log acquisition unit 50 acquires a message log with an upper limit of 1000 messages every 30 seconds. For example, the first operation management device 30a refers to the log file for the day on which the current day's message log is sequentially recorded, and obtains a record (message log) newly added to the log file up to 1000 records Repeat every 30 seconds. This separates the log browsing access from the development side and the log acquisition access to the operation side, and suppresses an increase in the processing load of the first operation management device 30a.

  The log recording unit 52 stores the message log acquired by the log acquisition unit 50 in the log storage unit 46 in association with the storage date and time indicating the current date and time. The log deletion unit 56 refers to the storage date and time of each message log stored in the log storage unit 46 and deletes the message log that has passed one year from the storage in the log storage unit 46. Note that the message log retention period may be adjusted between the operation department and the development department based on the number and amount of message logs acquired from the first operation management apparatus 30a, the capacity of the log storage unit 46, and the like.

  The log providing unit 54 transmits the message log data stored in the log storage unit 46 to the portal server 18 in response to the message log provision request received from the portal server 18. Specifically, the log providing unit 54 extracts a message log that matches the search condition specified by the providing request from the message logs stored in the log accumulation unit 46, and the extracted message log data is portal data. Send to server 18. Thus, since the message log provided to the portal server 18 is a message log stored in the log storage unit 46, log browsing by the user does not affect the first operation management apparatus 30a.

  The first log collection server 20a may be a database server, and may accept an SQL query indicating a search condition from the portal server 18. The first log collection server 20a may analyze the SQL query, format the message log data that matches the search condition into a format specified by the SQL query, and send it back to the portal server 18.

  The functional configuration of the second log collection server 20b in FIG. 1 is the same as that of the first log collection server 20a shown in FIG. However, the second log collection server 20b differs from the first log collection server 20a in that the message log provider (in other words, the acquisition destination) is the second operation management apparatus 30b. Note that the request source and the destination of the message log are the portal server 18 in the same manner as the first log collection server 20a.

  FIG. 3 is a block diagram showing a functional configuration of the portal server 18 of FIG. The portal server 18 includes a function of a web server that provides an operation portal site, which is a website that presents the operational status of an information system that is providing a service in an integrated manner. To provide. Hereinafter, the person in charge of the development department who accesses the portal server 18 is also referred to as a “user”.

  The portal server 18 includes a control unit 60, a storage unit 62, and a communication unit 64. The control unit 60 executes various data processing for providing the operation portal site. In addition, since the function of a web server is known, the structure for displaying the log information of an operation management apparatus in an operation portal site is demonstrated in detail below. The storage unit 62 is a storage area that stores data that is referred to or updated by the control unit 60. The communication unit 64 communicates with an external device according to a predetermined communication protocol. The control unit 60 transmits / receives data to / from an external device via the communication unit 64. The external devices in the embodiment include a PC 12a, a PC 12b, a first log collection server 20a, and a second log collection server 20b.

  The storage unit 62 includes an authentication information holding unit 66, a provider information holding unit 68, a job filter holding unit 70, and a search filter holding unit 72.

  The authentication information holding unit 66 is information for performing user authentication on the operation portal site, and stores information on users who are permitted to log in to the operation portal site. Specifically, the user ID, password, and group ID are stored in association with each other. The group ID is identification information of a group to which the user belongs among a plurality of groups (organizations) in the ICT service company. For example, the ID may be an ID of the first development department or the second development department, or may be an ID that is classified with a finer granularity. In the embodiment, a group is provided for each managed system that is responsible for maintenance (in other words, for each operation management apparatus that outputs a message log). The group ID can be said to be information for identifying the provider of the message log to be provided to the user.

  The provider information holding unit 68 holds information related to a message log provider. In other words, information for identifying a specific log collection server, which is a log collection entity, is held for a message log to be provided to a specific group of users. Specifically, the providing source information holding unit 68 holds IDs of a plurality of log collection servers and a plurality of group IDs in association with each other. The embodiment further holds the name of the operation management apparatus that is the main output of the message log, and the ID and name of the information system managed by the operation management apparatus. For example, the provider information holding unit 68 associates the ID of the first log collection server 20a with the name of the first operation management device 30a, the ID and name of the first management target system 32a, and the ID of the first development department. Hold a record.

  The job filter holding unit 70 holds the job filter set by the filter recording unit 92 described later in association with the group ID of the setting source user. The job filter indicates a search condition for extracting a message log related to a specific job, a net, or a frame from a plurality of message logs. The search filter holding unit 72 holds the search filter set by the filter recording unit 92 described later in association with the group ID of the setting source user. The search filter indicates a search condition for extracting a message having a specific content from a plurality of message logs. The job filter holding unit 70 and the search filter holding unit 72 can also be said to be search condition holding units that hold search conditions for narrowing down the message log provided to the user.

  The control unit 60 includes a request reception unit 74, a login processing unit 76, a screen generation unit 78, a log search unit 88, a screen providing unit 90, a filter recording unit 92, and a search result file providing unit 94. As will be described later, the screen generation unit 78, the log search unit 88, the screen providing unit 90, and the search result file providing unit 94 are accumulated in the first log collection server 20a and the second log collection server 20b by cooperating with each other. It functions as a log information provider that provides the message log information to the user.

  The request receiving unit 74 receives various requests for the operation portal site transmitted from the PC 12a (PC 12b). Access from the PC 12a (PC 12b) to the portal server 18 is restricted by the router 14 to HTTP access via a web browser.

  The login processing unit 76 executes a user login process on the operation portal site. The login processing unit 76 provides the web page of the login screen to the PC 12a (PC 12b), and acquires the user ID and password input on the login screen. The login processing unit 76 refers to the authentication information holding unit 66 and permits the user to log in when the combination of the user ID and the password matches that of the user permitted to log in. Also, the group ID associated with the combination of the user ID and password is identified, and the group ID is recorded in association with the user session.

  The screen generator 78 generates web page data indicating various screens of the operation portal site. The operation portal site provides a log viewer function, and provides the log viewer screen to the PC 12a or PC 12b that is a terminal of the logged-in user (also referred to as “requesting user”). The log viewer screen includes (1) job confirmation screen, (2) job filter setting screen, (3) log search screen, and (4) search filter setting screen. The screen generation unit 78 includes a job confirmation screen generation unit 80, a job filter setting screen generation unit 82, a log search screen generation unit 84, and a search filter setting screen generation unit 86 that generate data of these four screens.

(1) Job confirmation screen:
FIG. 4 shows an example of the job confirmation screen 100. The job confirmation screen 100 can also be said to be a job operation status confirmation screen. The job confirmation screen is a screen that displays a list of execution states of one or more jobs executed on the current day. The “current day” is a reference date based on the output date of the message log in the first operation management apparatus 30a and the second operation management apparatus 30b. In the first management target system 32a and the second management target system 32b, It has nothing to do with the operation date. Therefore, the job confirmation screen 100 on a certain day may display a message log extending over a plurality of operation dates.

  The job confirmation screen generation unit 80 includes the first log collection server 20a or the second log collection server 20b associated with the requesting user (which can be said to be a group to which the user belongs in the embodiment) in the providing source information holding unit 68. To obtain information indicating the acquisition status of the message log. The information is set in the log acquisition status area 101. The information indicating the acquisition status of the message log includes the contents indicating the success or failure of the message log acquisition process and the execution date and time. In addition, the job confirmation screen generation unit 80 sets the ID and name of the management target system associated with the requesting user in the providing source information holding unit 68 and the name of the operation management apparatus in the system information area 102.

  The job confirmation screen generation unit 80 is a screen element that displays a list of one or more job filter names registered in advance by the requesting user in the filter selection area 104, and is a screen element that accepts selection of a specific job filter Set. In the example of FIG. 4, a drop-down list is provided for allowing the user to select a desired job filter from among the five job filters registered by the group to which the requesting user belongs.

  When the job confirmation screen generation unit 80 accepts a selection operation on the search button 106, the ID of the specific log collection server associated with the group to which the requesting user belongs and the job filter (in the filter selection area 104) A job search request including job filter data stored in the job filter holding unit 70 is passed to the log search unit 88. The job confirmation screen generation unit 80 sets the message log data acquired by the log search unit 88 in the search result area 108 in response to the job search request.

  The job confirmation screen generation unit 80 sets corresponding item values of the message log in the operation date column to job date column of the search result area 108, respectively. When the status (job status) of the items matches a predetermined keyword such as “abnormal” or “abnormal end”, the item value is different from normal (for example, the background color is red, the character color is white, etc.) Display. In the message field of the search result area 108, the contents of each item of the message log are set as they are.

(2) Job filter setting screen:
FIG. 5 shows an example of the job filter setting screen 110. The job filter setting screen 110 is a screen for allowing the user to register a job filter that is a job extraction condition to be displayed on the job confirmation screen 100.

  The job filter setting screen generation unit 82 sets, in the system information area 102, the ID and name of the management target system associated with the requesting user in the providing source information holding unit 68, and the operation management apparatus name. The job filter setting screen generation unit 82 also has a filter name setting area 112 that allows the user to input an arbitrary character string as the name of the job filter. At the same time, a filter explanation setting area 113 is provided for allowing the user to input an arbitrary character string indicating the contents of the filter for supporting editing of the job filter at a later time.

  The names of jobs, nets, and frames are often determined according to the system naming rules, etc., but the names of job filters are users with low technical skills (for example, system development skills and system operation skills) ( For example, it is desirable to set an easy-to-understand name for an office worker or a sales person. For example, the names of jobs, nets, and frames are usually written in English, but the names of job filters may be written in Japanese. The same applies to the names of search filters described later. The names of job filters and search filters should be easy to understand even for users with low technical skills. For example, the name can be easily understood by users with a low level of system understanding. It can be easy.

  The job filter setting screen generation unit 82 is provided with a filter condition setting area 114 for allowing the user to input the contents of the job filter. In the filter condition setting area 114, a combination of a frame name, a net name, and a job name, which is a search condition for narrowing down message logs, is input. As shown in FIG. 5, a single job filter can specify a combination of a plurality of jobs, nets, and frames. In the job description setting area 116, an arbitrary character string that describes the contents of the frame, net, and job to be searched is input. As shown in FIG. 4, the character string set in the job description setting area 116 is transcribed in the description column of the search result area 108 of the job confirmation screen 100.

  When the confirm button 118 is selected on the job filter setting screen 110, the filter recording unit 92 stores the user input contents on the job filter setting screen 110 in the job filter holding unit 70 as a job filter. Specifically, the filter name input in the filter name setting area 112, the description input in the filter description setting area 113, and the filter condition input in the filter condition setting area 114 in association with the group ID of the request source user Are stored in the job filter holding unit 70. A plurality of job filters can be registered in one group, and a plurality of job filters registered in a group are displayed in a list so as to be selectable on the job confirmation screen of the user of the group. The same applies to the search filter described later.

(3) Log search screen:
FIG. 6 shows an example of the log search screen 120. The log search screen 120 is a screen for searching a desired message log from the message logs for the past year accumulated in the first log collection server 20a or the second log collection server 20b.

  The log search screen generation unit 84 acquires information indicating the acquisition status of the message log from the first log collection server 20a or the second log collection server 20b associated with the request source user in the provider information holding unit 68. The information is set in the log acquisition status area 101. The information indicating the acquisition status of the message log includes the contents indicating the success or failure of the message log acquisition process and the execution date and time. Further, the log search screen generation unit 84 sets the ID and name of the management target system associated with the requesting user in the providing source information holding unit 68 and the operation management device name in the system information area 102.

  The log search screen generation unit 84 provides a search condition setting area 122 for allowing a user to input message log search conditions (hereinafter referred to as “search filter”) to be displayed on the log search screen 120. Information items that can be specified as a search filter are a message log output period, a message ID, a status flag, a node ID / node name, a transmission source, and contents. The content is a search character string for searching the entire message log, that is, a keyword or key phrase.

  The log search screen generation unit 84 is a screen element that displays a list of names of one or more search filters registered in advance by the requesting user in the filter selection area 124, and is a screen element that accepts selection of a specific search filter Set. This screen element is, for example, a drop-down list. The user can select a desired search filter corresponding to the survey content or the like from one or more search filters whose names are displayed in the filter selection area 124.

  When the log search screen generation unit 84 accepts a selection operation on the search button 126, the ID of the specific log collection server associated with the group to which the requesting user belongs and the search filter specified on the log search screen 120 are displayed. A log search request including data is passed to the log search unit 88. When a specific search filter is selected in the filter selection area 124 of the log search screen 120, the log search screen generation unit 84 acquires the data of the specific search filter from the search filter holding unit 72 and makes a log search request. Set. In addition, when the contents of the search filter are input in the search condition setting area 122 of the log search screen 120, the log search screen generation unit 84 sets the data of the search filter input in the filter selection area 124 in the log search request. To do.

  Furthermore, when a search filter is specified in both the filter selection area 124 and the search condition setting area 122, the log search screen generation unit 84 sets the search filter data and the search condition setting selected in the filter selection area 124. A search condition obtained by combining the search filter data input in the area 122 with an AND condition is generated and set in the log search request. As a modified example, a search condition that combines the search filter data selected in the filter selection area 124 and the search filter data input in the search condition setting area 122 with an OR condition is generated and set in the log search request. May be. The log search screen generation unit 84 sets the message log data acquired by the log search unit 88 in the search result area 128 in response to the log search request.

  When the selection operation for the CSV output button 130 on the log search screen 120 is accepted, the search result file providing unit 94 converts the message log data set in the search result area 128 at that time into CSV (Comma Separated Value) format. Save to an electronic file (hereinafter referred to as “search result file”). The search result file providing unit 94 transmits the search result file to the terminal (PC 12a or PC 12b) of the requesting user. That is, the user in the development department can download the search result file to his / her own PC and analyze the message log.

  As a modification, when a selection operation for the CSV output button 130 on the log search screen 120 is accepted, the log search screen generation unit 84 and the log search unit 88 perform message log search according to the search filter specified on the log search screen 120. The process may be executed again. The search result file providing unit 94 may store the message log data acquired by the log search unit 88 in the search result file. Thereby, it is possible to provide a search result file including the latest message log when a selection operation for the CSV output button 130 is input.

(4) Search filter setting screen:
FIG. 7 shows an example of the search filter setting screen 140. The search filter setting screen 140 is a screen for allowing a user to register a search filter used as a search condition for message logs to be displayed on the log search screen 120. That is, the search filter registered in the search filter setting screen 140 can be selected in the filter selection area 124 of the log search screen 120.

  The search filter setting screen generation unit 86 sets, in the system information area 102, the ID and name of the management target system associated with the requesting user in the providing source information holding unit 68, and the operation management device name. The search filter setting screen generation unit 86 also has a filter name setting area 142 that allows the user to input an arbitrary character string as the name of the search filter. Further, the search filter setting screen generation unit 86 provides a filter condition setting area 144 for allowing the user to input the contents of the search filter. In the filter condition setting area 144, it is possible to input an arbitrary combination of a state, a message ID, a node ID, a node name, a transmission source, contents, and the like as conditions for narrowing the message log.

  When the add button 146 is selected on the search filter setting screen 140, the filter recording unit 92 stores the user input content on the search filter setting screen 140 in the search filter holding unit 72 as a search filter. Specifically, the filter name input in the filter name setting area 142 and the filter condition input in the filter condition setting area 144 are stored in the search filter holding unit 72 in association with the group ID of the requesting user. When the input content to the filter name setting area 142 is an existing filter name, in other words, the search filter data having the name input to the filter name setting area 142 already exists in the search filter holding unit 72. The filter recording unit 92 may update the content of the existing search filter with the filter condition input in the filter condition setting area 144. In this case, the add button 146 functions as a change button for changing an existing search filter.

  Returning to FIG. 3, when the log search unit 88 receives a job search request from the job confirmation screen generation unit 80, the message log accumulated in the first log collection server 20 a or the second log collection server 20 b specified in the request. The message log that matches the job filter search condition specified in the request is searched (or extracted). The search range by the job search request is the message log acquired on the current day. In other words, the message log associated with the storage date and time indicating the current day is the search target.

  When the log search unit 88 acquires a message log that matches the search condition from the first log collection server 20a or the second log collection server 20b, the log search unit 88 passes the acquired message log data to the job confirmation screen generation unit 80 to confirm the job. The screen 100 is set. The log search unit 88 generates an SQL query indicating the search condition specified in the job search request, and transmits the SQL query to the first log collection server 20a or the second log collection server 20b specified in the request. May be. Then, as a response to the SQL query, message log data matching the search condition may be acquired from the first log collection server 20a or the second log collection server 20b.

  In addition, when the log search unit 88 receives a log search request from the log search screen generation unit 84, the log search unit 88 selects from the message logs stored in the first log collection server 20a or the second log collection server 20b specified in the request. Search for a message log that matches the search filter search conditions specified in the request. The search target by the log search request is a message log for the past year including the current day. In other words, all message logs stored in the first log collection server 20a and the second log collection server 20b are search targets.

  When the log search unit 88 acquires the message log that matches the search condition from the first log collection server 20a or the second log collection server 20b, the log search unit 88 passes the acquired message log data to the log search screen generation unit 84 for log search. The screen 120 is set. When the log search unit 88 receives a log search request, the log search unit 88 may transmit an SQL query to the first log collection server 20a or the second log collection server 20b as in the case of receiving a job search request.

  The screen providing unit 90 transmits the operation portal site screen generated by the screen generation unit 78 to the requesting user terminal, and displays the operation portal site screen on the display of the user terminal. In the embodiment, the web page data of the job confirmation screen 100, job filter setting screen 110, log search screen 120, and search filter setting screen 140 is transmitted to the PC 12a or PC 12b. The web browser activated by the PC 12a or the PC 12b displays the web pages of the job confirmation screen 100, job filter setting screen 110, log search screen 120, and search filter setting screen 140 provided from the portal server 18.

The operation of the enterprise system 1 having the above configuration will be described with reference to FIG.
The first operation management apparatus 30a sequentially records a message log indicating the operation status of the first management target system 32a that is providing the service, using a known operation management manager function. Similarly, the second operation management device 30b sequentially records a message log indicating the operation status of the second management target system 32b that is providing the service. The log acquisition unit 50 of the first log collection server 20 a periodically acquires message logs from the first operation management apparatus 30 a and stores them in the local log storage unit 46. The log acquisition unit 50 of the second log collection server 20b periodically acquires a message log from the second operation management apparatus 30b and stores it in the local log storage unit 46.

  In this case, the person in charge of the first development department (hereinafter referred to as “the first management target system 32a”) or the necessity of analyzing the trend of the job execution time in the first management target system 32a. It is assumed that it is necessary to check the message log of the first operation management apparatus 30a. In response to a user operation, the web browser of the PC 12a accesses the portal server 18 and logs in to the operation portal site. When the portal server 18 succeeds in user authentication, the portal server 18 identifies the first log collection server 20a associated in advance with the first development department, which is the group to which the user belongs, as the message log provider, and the first log collection server 20a. Is recorded in association with the user's session. When the login user belongs to the second development department, the second log collection server 20b associated with the second development department in advance is identified as the message log provider.

  When the user should confirm the job execution status, the user selects a job confirmation screen on the operation portal site. The portal server 18 provides a job confirmation screen web page to the PC 12a for display. The job confirmation screen displays a list of selectable job filter names registered by the user group. When the name of a specific job filter is selected in the filter selection area of the job confirmation screen and the search button is pressed, the portal server 18 searches the message log for the current day stored in the first log collection server 20a for the population of the search. As a result, the search result by the job filter selected by the user is displayed on the job confirmation screen.

  When creating or editing a job filter, the user selects a job filter setting screen on the operation portal site. The portal server 18 provides the web page of the job filter setting screen to the PC 12a for display. When the job filter content is entered on the job filter setting screen and the add button is pressed, the portal server 18 receives the job filter data (including the job filter name set by the user) entered on the job filter setting screen. Records in association with the user's group. The job filter names recorded here are displayed in a selectable manner on the job confirmation screen.

  The user selects a log search screen on the operation portal site when the search is not limited to a job but should be performed on logs of various types and contents. The portal server 18 provides a log search screen web page to the PC 12a for display. The log search screen displays a list of search filter names registered by the user group. When the name of a specific search filter is selected in the filter selection area of the log search screen and the search button is pressed, the portal server 18 searches the message log for one year stored in the first log collection server 20a. As a group, the search result by the search filter selected by the user is displayed on the log search screen.

  When a user should create / edit a search filter, the user selects a search filter setting screen on the operation portal site. The portal server 18 provides and displays the web page of the search filter setting screen to the PC 12a. When the content of the search filter is input on the search filter setting screen and the confirm button is pressed, the portal server 18 receives the search filter data (including the name of the search filter set by the user) input on the search filter setting screen. Records in association with the user's group. The name of the search filter recorded here is displayed in a selectable manner on the log search screen.

  The search target on the job confirmation screen is the message log for the current day, while the search target on the log search screen is the message log for the past year in addition to the current day. Therefore, when the job execution status of the current day should be confirmed, the search result can be quickly confirmed by using the job confirmation screen instead of the log search screen.

  According to the portal server 18, the first log collection server 20 a, and the second log collection server 20 b (hereinafter collectively referred to as “information providing apparatus 22”) according to the embodiment, the person in charge of the development department is in his / her own PC. The latest message log output by the operation management apparatus can be referred to and acquired. For example, when a person in charge of the first development department receives a notification mail of the occurrence of a failure from the first operation management apparatus 30a, the person in charge immediately accesses the operation portal site with the web browser of the PC 12a, and the first operation management apparatus 30a outputs it. You can start troubleshooting by viewing the message log.

  Currently, there is a demand for efficiency and sophistication of internal control in companies, and even ICT service companies are required to separate development and operation, and separation of production environment and development environment. According to the information providing apparatus 22, it is possible to realize a mechanism in which the operation is not involved in the acquisition and reference of the message log output by the operation management apparatus in the production environment. Thereby, separation of development and operation, and separation of the production environment and the development environment can be realized. This is also useful in responding to recent system audits that require separation of development and operation.

  Furthermore, the information providing device 22 is effective in avoiding security risks. For example, (1) it is not necessary to enter the production terminal room for log acquisition, and it is not necessary to bring a USB memory into the production terminal room, which is effective in avoiding risks in the production terminal room. (2) Since the use of the production terminal room is reduced, the chance of touching the production terminal of another system is reduced, and the influence on the other system can be avoided. For example, it becomes easy to prevent a person in charge of the first development department from accessing the second operation management apparatus 30b (second management target system 32b) that is not in charge.

  (3) The user has only the authority to refer to the message log, and the user cannot directly access the operation management apparatus in the production environment. Further, even if the usage frequency of the user increases, the access frequency from the information providing device 22 to the operation management device does not change. Even if a communication function such as FTP can be used from the production terminal in the production terminal room to the operation management apparatus, data and scripts cannot be input / output to / from the operation management apparatus via the log viewer screen. Therefore, the risk of the production environment operation management device can be avoided.

  Furthermore, so far, the message log can only be referred to the retention period (for example, one week) by the operation management apparatus in the production environment. The information providing apparatus 22 retains the message log acquired from the operation management apparatus for a period (for example, one year) longer than the retention period by the operation management apparatus in the production environment, and enables browsing with the log viewer. As a result, it is possible to check the system operation status retroactively. For example, it is possible to grasp the status of a failure several months ago, and it is also possible to grasp the change tendency of job execution time.

  Furthermore, in the information providing apparatus 22, a log collection server is provided for each operation management apparatus. In the example of FIG. 1, a first log collection server 20a that collects message logs of the first operation management apparatus 30a and a second log collection server 20b that collects message logs of the second operation management apparatus 30b are provided separately. As a result, message logs output from different operation management apparatuses do not coexist in the same log collection server, and it is easy to reliably prevent the user from browsing the message log of the non-charged system. That is, it is possible to prevent the message logs of different customer systems from being mixed and to avoid the risk of information security.

  Furthermore, in the information providing apparatus 22, job filters and search filters are managed for each user group, and the same filter (one or more filters) can be selected for each user group. Thereby, a user can be supported so that a message log can be searched efficiently.

  The present invention has been described based on the embodiments. The embodiments are exemplifications, and it is understood by those skilled in the art that various modifications can be made to combinations of each component and each processing process, and such modifications are also within the scope of the present invention.

  Although not mentioned in the above embodiment, the job confirmation screen generation unit 80 may arrange an update button for instructing to acquire the latest message log on the job confirmation screen. Similarly, the log search screen generation unit 84 may arrange an update button on the job confirmation screen. The portal server 18 further includes a log update instruction unit, and when the log update instruction unit receives an update button selection operation, the log collection server corresponding to the requesting user receives a predetermined command for obtaining the latest message log. You may transmit to (here, it is set as the 1st log collection server 20a). When receiving the command, the log acquisition unit 50 of the first log collection server 20a immediately acquires the latest message log from the first operation management device 30a regardless of the elapse of a predetermined log acquisition time. As a result, a search including the latest message log as a search target can be performed on the job confirmation screen and the log search screen.

  When the update button is selected, if the job filter or the search filter has been selected, in other words, if the search condition has been set, the log search unit 88 collects the first log after the transmission of the command. The search process for the message log stored in the server 20a may be automatically executed.

  In the above embodiment, the first operation management device 30a and the second operation management device 30b are installed in the operation side network, and the PC 12a and the PC 12b are installed in the development side network that is prohibited from accessing the operation side network. Therefore, the information providing apparatus 22 is installed in a neutral network independent of those networks. However, the information providing device 22 is useful for improving the security of the first operation management device 30a and the second operation management device 30b regardless of the network configuration. For example, in a situation in which the PC 12a and the PC 12b are prohibited from accessing the first operation management device 30a and the second operation management device 30b, the information providing device 22 makes a connection to the PC 12a and the PC 12b according to the configuration of the embodiment. A log viewer capable of browsing the logs recorded by the first operation management device 30a and the second operation management device 30b can be provided, and effects similar to those of the embodiment can be obtained.

  Any combination of the above-described embodiments and modifications is also useful as an embodiment of the present invention. The new embodiment generated by the combination has the effects of the combined embodiment and the modified examples. In addition, it should be understood by those skilled in the art that the functions to be fulfilled by the constituent elements described in the claims are realized by the individual constituent elements shown in the embodiments and the modified examples or by their cooperation. .

  DESCRIPTION OF SYMBOLS 1 Enterprise system, 18 Portal server, 20a 1st log collection server, 20b 2nd log collection server, 22 Information provision apparatus, 30a 1st operation management apparatus, 30b 2nd operation management apparatus, 46 Log storage part, 50 Log acquisition part 78 screen generation unit, 88 log search unit, 90 screen providing unit, 92 filter recording unit.

Claims (8)

An information providing apparatus provided independently of an operation management apparatus that manages the operation of a predetermined information system,
A log acquisition unit for acquiring from the operation management apparatus a log indicating whether or not the operation state of the information system recorded and held by the operation management apparatus is normal ;
A log holding unit for holding a log acquired by the log acquisition unit;
A log information providing unit for providing information indicated by the log held in the log holding unit to the user's terminal when receiving a log browsing request from the user's terminal prohibited from accessing the operation management device; ,
An information providing apparatus comprising: The operation management device is installed in the first network,
The user terminal is installed in a second network where access to the first network is prohibited,
The information providing apparatus according to claim 1, wherein the information providing apparatus is installed in a third network different from the first network and the second network. The log holding unit, a period longer than the period of logs similar the management device is held, the information providing apparatus according to 請 Motomeko 1, that holds a log. A search condition holding unit that holds a plurality of search conditions for searching for information to be presented to the user from information indicated by the log acquired by the log acquisition unit;
The log information providing unit displays a screen element for selecting an arbitrary search condition from the plurality of search conditions on a log browsing screen provided to the user terminal, and is selected by the user terminal The information providing apparatus according to claim 1, wherein information on a log that matches a search condition is displayed on the log browsing screen.   The log information providing unit displays a search condition setting screen in which an arbitrary name can be set for a search condition on the terminal of the user, and displays the name of each search condition on the screen element of the log browsing screen. Item 5. The information providing apparatus according to Item 4.   6. The log acquisition unit according to claim 1, wherein the log acquisition unit periodically acquires a log from the operation management apparatus at a predetermined frequency regardless of a frequency of receiving the log browsing request from the user terminal. The information providing apparatus according to the description. A computer provided independently of an operation management device that manages the operation of a predetermined information system,
Acquiring from the operation management apparatus a log indicating whether the operation state of the information system recorded and held by the operation management apparatus is normal and storing the acquired log in a storage unit different from the operation management apparatus When,
Providing the information indicated by the log stored in the storage unit to the user's terminal when receiving a log browsing request from the user's terminal prohibited from accessing the operation management device;
To provide information. In a computer provided independently of the operation management device that manages the operation of a given information system,
A function of acquiring from the operation management apparatus a log indicating whether the operation state of the information system recorded and held by the operation management apparatus is normal, and storing the acquired log in a storage unit different from the operation management apparatus When,
A function of providing information indicated by the log stored in the storage unit to the user terminal when receiving a log browsing request from a user terminal that is prohibited from accessing the operation management apparatus;
Computer program for realizing.

Images