JP6040894B2 - Log generation apparatus and log generation method - Google Patents

Description

  The present invention relates to a log generation device that generates, as a log, an event that occurs during processing of a network system or a program.

  In a network system or program event trace, etc., generating and acquiring events generated during processing as a log is generally used for processing status confirmation, failure analysis, and the like. Logs may be generated under individual time management in the environment of multiple computers, and it is necessary to grasp the relationship between events that occurred in multiple environments in order to check the processing status and analyze the failure. is there. In this case, it is necessary to combine logs generated in a plurality of environments into one log while maintaining the order of event occurrence. However, the time measured in multiple environments differs for each environment, so even if the logs are simply compiled based on the time, the logs are not arranged in the order in which they actually occurred. There is.

  For the above problem, a method of collecting logs in the order of event occurrence is disclosed. For example, in Patent Document 1 and Patent Document 2, the time of logs generated in a plurality of environments is corrected by a synchronized process, Logs are compiled based on the corrected time. Further, in Patent Document 3, sequence numbers that are unified in all environments are assigned to logs generated in a plurality of environments, and the logs are rearranged based on the sequence numbers to collect the logs.

JP 2011-1544489 A JP 2012-2106040 A JP 2006-18701 A

  In the conventional log generation apparatus, when logs generated in a plurality of environments are collected, in Patent Document 1 and Patent Document 2, it is necessary to transfer logs generated in different environments. In addition, it was necessary to correct the time of the transferred log. For this reason, when the log generation interval is shortened, there is a problem that the log transfer load is large, and the event logs are not arranged in the order of occurrence due to the problem of time correction accuracy. In Patent Document 3, processing such as log sorting is necessary, and there is a problem that the load increases as the number of data to be sorted increases.

  The present invention has been made to solve the above-described problems, and an object of the present invention is to arrange event logs in order of occurrence while suppressing the processing load of collecting logs generated in a plurality of environments.

  In order to solve the above-described problem, a log generation device according to the present invention includes an identifier generation unit that generates an identifier for uniquely identifying a log of a guest OS, and the identifier generated by the identifier generation unit A guest OS log generation unit that records the guest OS log in association with a log, an identifier notification unit that notifies the identifier generated by the identifier generation unit, and the identifier notified by the identifier notification unit as a host OS log A host OS log generation unit to be recorded on the host OS log, and a log corresponding to the identifier recorded in the host OS log by the host OS log generation unit is extracted from the guest OS log recorded by the guest OS log generation unit A merge unit that replaces the identifier is provided.

  The log generation method of the present invention includes an identifier generation step for generating an identifier for uniquely identifying a guest OS log by an identifier generation unit, and the identifier generated by the identifier generation step by a guest OS log generation unit as a guest A guest OS log generation step of recording in the guest OS log in association with an OS log; an identifier notification step of notifying the identifier generated by the identifier generation step by an identifier notification unit; and the identifier by the host OS log generation unit A host OS log generation step for recording the identifier notified in the notification step in a host OS log, and a log corresponding to the identifier recorded in the host OS log by the host OS log generation step by a merge unit The guest recorded by the log generation step Extracts from S log is obtained by a further comprising a merging step of replacing said identifier.

  According to the present invention, the event log can be arranged in the order of occurrence and collected only by referring to the guest OS log based on the identifier recorded in the host OS log in the merge unit. This reduces the load of log data transfer and eliminates the need for processing such as sorting when collecting logs, reducing the processing load of collecting logs generated in multiple environments, There is an effect that logs can be arranged in the order of occurrence.

1 is a configuration diagram of an information processing apparatus showing an example of a log generation apparatus according to Embodiment 1. FIG. 1 is a diagram illustrating a configuration example of a log generation device according to Embodiment 1. FIG. 4 is a diagram illustrating an example of a guest OS log 12, a host OS log 13, and a merge log 14. FIG. 4 is a flowchart showing a flow of processing on the guest OS 3 side in the first embodiment. 3 is a flowchart showing a flow of processing on the host OS 2 side in the first embodiment. 6 is a diagram illustrating a configuration example of a log generation device according to Embodiment 2. FIG. 10 is a flowchart showing a flow of processing on the guest OS 3 side in the second embodiment. FIG. 10 is a diagram illustrating a configuration example of a log generation device according to a third embodiment. 14 is a flowchart showing a flow of processing on the guest OS 3 side in the third embodiment. FIG. 10 is a configuration diagram of an information processing device showing an example of a log generation device according to Embodiment 4; FIG. 10 is a diagram illustrating a configuration example of a log generation device according to a fourth embodiment.

Embodiment 1 FIG.
FIG. 1 is a configuration diagram of an information processing apparatus showing an example of a log generation apparatus according to the first embodiment.
In FIG. 1, the information processing apparatus has a host OS 2 running on a computer 1, a guest OS 3, a virtual machine monitor (VMM) 4, and a host OS log generation unit 5 running on the host OS 2. The log generation unit 7 is configured to operate on the guest OS 3. The virtual machine monitor (VMM) 4 includes an event generation unit 8 that operates on the host OS 2, and the host OS 2 includes a merge unit 6.

  The host OS 2 is an OS serving as a base on which a virtual machine program is operated in a virtual machine that constructs another computer environment on the computer. The guest OS 3 is an OS of a virtual machine operating on the host OS 2. The guest OS 3 is operated by a virtual machine monitor (VMM) 4 which is software for realizing a virtual machine. Both the host OS 2 and the guest OS 3 include a host OS log generation unit 5 and a guest OS log generation unit 7 that generate a log by tracking an execution path and an event of each process. The event referred to here indicates processing that has occurred in the host OS 2 and the guest OS 3 and is output by the host OS log generation unit 5 and the guest OS log generation unit 7. In addition, the host OS log generation unit 2 and the guest OS log generation unit 7 can track only the processes generated in each OS. That is, the processing generated in the guest OS 3 cannot be traced by the host OS log generation unit 5 on the host OS 2.

FIG. 2 is a diagram illustrating a configuration example of the log generation device according to the first embodiment.
In FIG. 2, the guest OS log generation unit 7 includes an identifier generation unit 10 that generates and assigns an identifier to the generated log, and an identifier notification unit 11 that notifies the virtual machine monitor (VMM) 4 of the identifier. I have. In addition, the guest OS log generation unit 7 records the log with the identifier in the guest OS log 12.

  The virtual machine monitor (VMM) 4 includes an event generation unit 8. When the notification of the identifier is received from the identifier notification unit 11 of the guest OS log generation unit 7, a host OS log is generated using the event generation unit 8. An event with an identifier is sent to the unit 5.

  The host OS log generation unit 5 records events that occur on the host OS 2 in the host OS log 13. Further, the host OS log generation unit 5 records a log in which the identifier is embedded in the host OS log 13 based on the event notification with the identifier from the event generation unit 8 of the virtual machine monitor (VMM) 4.

  The merge unit 6 extracts the log corresponding to the identifier embedded in the host OS log 13 from the guest OS log 12 and replaces the identifier embedded in the host OS log 13 with the log extracted from the guest OS log 12. Then, a merge log 14 in which the logs of the guest OS 3 and the host OS 2 are merged is generated.

FIG. 3 is a diagram illustrating an example of the guest OS log 12, the host OS log 13, and the merge log 14.
In FIG. 3, the guest OS log 12 records an identifier for uniquely identifying each event, the time when the event occurred, and event information. In this example, the identifier is a sequence number that increments the number every time an event occurs. However, any identifier that can be uniquely identified may be used. For example, a character string may be used as the identifier. Good. However, since this identifier is notified from the guest OS 3 to the host OS 2, it is desirable that the identifier has a short length and a small amount of data. Further, the host OS log 13 records the time when the event occurred and the identifier notified from the event or the event generator 8 of the virtual machine monitor (VMM) 4. The guest OS log 12 and the host OS log 13 are merged to generate a merge log.

Next, the operation of the log generation device according to the first embodiment will be described with reference to FIGS.
FIG. 4 is a flowchart showing the flow of processing on the guest OS 3 side in the first embodiment.
FIG. 5 is a flowchart showing the flow of processing on the host OS 2 side in the first embodiment.

Hereinafter, the flow of processing on the guest OS 3 side will be described with reference to FIG.
First, in step S101, the guest OS log generation unit 7 prepares for log generation. In preparation for log generation, log acquisition conditions are set. For example, it is set which CPU core is designated as the log acquisition target, or whether the log acquisition unit is an event unit or a function unit. Furthermore, as an optional function, it can also be specified to output in a display format that can trace the function call relationship.
Next, in step S102, the guest OS log generation unit 7 waits until an event that generates a log occurs, and when an event that generates a log occurs, the process proceeds to the branch of S103.
Next, in step S103, the guest OS log generation unit 7 assigns an identifier to the generated log by the identifier generation unit 10, and uses the identifier as a virtual machine monitor (VMM) 4 operating on the host OS 2. Notify
Next, in step S <b> 104, the guest OS log generation unit 7 outputs the log with the identifier to the guest OS log 12. An example of an output format to the guest OS log 12 is as shown in FIG.
Next, in step S105, the guest OS log generation unit 7 repeats steps S102 to S105 until the log generation end condition is satisfied. The log generation end condition is, for example, when a preset log acquisition period is satisfied, or when a log acquisition end signal is generated.

Next, the flow of processing on the host OS 2 side will be described with reference to FIG.
First, in step S201, the host OS log generation unit 5 prepares for log generation. In preparation for log generation, a log acquisition condition is set in the same manner as in step S101 on the guest OS3 side.
Next, in step S202, the host OS log generation unit 5 stands by until an event that generates a log or an event notification with an identifier from the virtual machine monitor (VMM) 4 occurs. In the event notification processing with an identifier from the virtual machine monitor (VMM) 4, when the identifier is notified from the guest OS log generation unit 7 to the virtual machine monitor (VMM) 4, the event generation unit of the virtual machine monitor (VMM) 4 8 generates an event with an identifier and notifies the host OS log generation unit 5 of the event. The host OS log generation unit 5 waits as described above. If an event that generates a log occurs, the process proceeds to a branch in step S203. If an event notification with an identifier occurs, the process proceeds to a branch in step S204.
Next, when an event for generating a log occurs in step S202, the host OS log generation unit 5 outputs the generated log to the host OS log 13 in step S203. An example of an output format to the host OS log 13 is as shown in FIG.
On the other hand, if an event notification with an identifier occurs in step S202, the host OS log generation unit 5 outputs the identifier to the host OS log 13 in step S204. The identifier may be anything that can be uniquely identified without duplication, and may be a sequence number that increments a number each time an event occurs, for example.
Next, in step S205, the host OS log generation unit 5 repeats steps S202 to S205 until a log generation end condition is satisfied. The log generation end condition is, for example, when a preset log acquisition period is satisfied, or when a log acquisition end signal is generated.
Next, in step S206, the merging unit 6 collects the guest OS log 12 of the guest OS 3 and the host OS log 13 of the host OS 2.
Finally, in step S206, the merge unit 6
A log corresponding to the identifier inserted in the host OS log 13 is extracted from the guest OS log 12 and a log corresponding to the identifier embedded in the host OS log 13 is extracted, and the identifier embedded in the host OS log 13 is It replaces with the log extracted from the guest OS log 12 and generates a merge log 14 in which the logs of the guest OS 3 and the host OS 2 are merged.

  As described above, in the invention of the first embodiment, the guest OS log generation unit 7 includes the identifier generation unit 10 and the identifier notification unit 11, and at the timing when the guest OS log 12 is generated by the identifier notification unit 11, The identifier is notified to the host OS log generation unit 5 via the virtual machine monitor (VMM) 4 and recorded together with the host OS log 13, whereby the identifier recorded in the host OS log 13 by the merge unit 6. By simply referring to the guest OS log 12, the event logs can be arranged in order of occurrence and collected. This reduces the load of log data transfer and eliminates the need for processing such as sorting when collecting logs, reducing the processing load of collecting logs generated in multiple environments, Logs can be arranged in order of occurrence.

  Furthermore, since only the identifier is notified, even if the output format of the log data is changed, the operation can be performed without considering the interface change of the output format.

Embodiment 2. FIG.
In the first embodiment, identifiers are notified at each timing when an event of the guest OS 3 occurs, and the events are arranged in the order of occurrence. In the second embodiment, it is desired to reduce the load due to identifier notification. In this case, an embodiment is shown in which identifiers are notified at periodic timing. Hereinafter, the configuration of the log generation device 9 according to the second embodiment and the processing flow of log generation will be described with reference to FIGS.

FIG. 6 is a diagram illustrating a configuration example of a log generation device according to the second embodiment.
6, the configuration related to the host OS 2 is the same as that in FIG. 2 of the first embodiment, but the configuration related to the guest OS 3 is different, and a periodic timer unit 15 is added to the guest OS 3. In addition, a periodic interrupt generation unit 18 that notifies the guest OS 3 of a periodic interrupt is provided. Further, instead of including the identifier generation unit 10 and the identifier notification unit 11 described in FIG. 1 of the first embodiment in the guest OS log generation unit 7, the periodic timer unit 15 includes an identifier generation unit 16 and an identifier notification unit 17.

  The periodic timer unit 15 receives the interrupt notification from the periodic interrupt generation unit 18 and periodically executes the identifier generation unit 16 and the identifier notification unit 17. The identifier generation unit 16 generates an identifier each time it is executed, and the identifier notification unit 17 notifies the guest OS log generation unit 7 and the virtual machine monitor (VMM) 4 on the host OS 2 of the identifier. Upon receiving the identifier notification from the identifier notification unit 17, the guest OS log generation unit 7 records the identifier in the guest OS log 12. On the other hand, the recording of the identifier on the host OS 2 side when receiving the notification of the identifier from the identifier notifying unit 17 is the same as the processing of the first embodiment. The merging unit 6 refers to the identifier recorded in the guest OS log 12 from the identifier recorded in the host OS log 13, collects the logs up to the next identifier, and generates the merge log 14.

  In the second embodiment, the guest OS log generation unit 7 records the identifier in the guest OS log 12, but the wake-up timing of the periodic timer unit 15 and the identifier need only be linked on the log. The identifier is not limited to being recorded in the guest OS log 12. For example, when the guest OS log generation unit 7 that can record the wake-up timing of the timer as a log is used, it can be realized by a method of recording an identifier in the log of the wake-up timing of the timer.

  Note that the periodic interrupt generation unit 18 may be realized by either software or hardware as long as it can generate interrupts periodically.

Next, the operation of the log generation device according to Embodiment 2 will be described with reference to FIG.
FIG. 7 is a flowchart showing the flow of processing on the guest OS 3 side in the second embodiment.
Note that the processing flow on the host OS 2 side is the same as that of the first embodiment, and thus the description thereof is omitted.

First, in step S301, the cycle timer unit 15 sets a timer. In the timer setting, the log acquisition period is set.
Next, in step S302, the cycle timer unit 15 waits until it is woken up by the cycle interrupt generation unit 18, and when it wakes up, proceeds to the branch of step S303.
Next, in step S303, the periodic timer unit 15 notifies the guest OS log generation unit 7 and the virtual machine monitor (VMM) 4 of the host OS 2 of the identifier.
Next, in step S304, the cycle timer unit 15 repeats steps S402 to S403 until a log generation end condition is satisfied. The log generation end condition is, for example, when a preset log acquisition period is satisfied, or when a log acquisition end signal is generated.

Next, the process flow of the guest OS log generation unit 7 will be described.
First, in step S401, the guest OS log generation unit 7 prepares for log generation. Preparation for log generation is the same processing as in the first embodiment.
Next, in step S <b> 402, the guest OS log generation unit 7 waits until an event for generating a log or an identifier notification from the periodic timer unit 15 is received. When an event for generating a log occurs, the process proceeds to the branch of step S403. If an identifier notification is received from the cycle timer unit 15, the process proceeds to a branch of step S404.
Next, when an event that generates a log occurs in step S <b> 402, the guest OS log generation unit 7 outputs the generated log to the guest OS log 12 in step S <b> 403. An example of an output format to the guest OS log 12 is as shown in FIG.
Next, when an identifier notification is received from the periodic timer unit 15 in step S402, the guest OS log generation unit 7 outputs a log to which the received identifier is assigned to the guest OS log 12 in step S404.
Next, in step S405, the guest OS log generation unit 7 repeats steps S402 to S405 until a log generation end condition is satisfied. The log generation end condition is, for example, when a preset log acquisition period is satisfied, or when a log acquisition end signal is generated.

  In the second embodiment, the accuracy with which the log event generation order can be guaranteed varies depending on the interrupt generation interval at which the periodic timer unit 15 is executed. For example, when the periodic timer unit 15 is activated at 1 second intervals, the order of occurrence of events at 1 second intervals can be guaranteed, but the order of event occurrence within 1 second intervals cannot be guaranteed. When this periodic interval is brought close to the event occurrence interval, the processing load is almost the same as in the first embodiment, and the accuracy with which the order of event occurrence can be guaranteed is substantially the same as in the first embodiment.

  As described above, according to the second embodiment, the identifier is not notified every time the event occurs, but the identifier is notified by the periodic timer, and the notification frequency of the identifier is lower than that at every event occurrence. There is an effect that the load of processing of generation / notification / recording is reduced.

Embodiment 3 FIG.
In the first and second embodiments described above, different embodiments have been shown depending on whether an identifier is notified every time an event occurs or an identifier is notified every fixed period. In the third embodiment, the first embodiment is different from the first embodiment. By using 2 together, it is possible to adjust the load required for processing and the accuracy for guaranteeing the order of event occurrence. For example, when an identifier is notified for each event occurrence with respect to an event with a rare occurrence frequency using the first embodiment, the load is very low, but the accuracy of guaranteeing the order of occurrence of events that do not notify the identifier Becomes lower. In addition to the setting for notifying an identifier for each occurrence of an event, by using the second embodiment, by notifying an identifier at an interval shorter than an event with a rare occurrence frequency, an event with a rare occurrence frequency has not occurred. Therefore, it is possible to guarantee the accuracy of the order of event occurrence based on the identifier for each fixed period.

  In the first embodiment, it is necessary to generate, assign, and notify identifiers for all logs generated in the guest OS 3. However, by using the first and second embodiments together, only specific events are generated. Logs can be collected just by notifying the event, and the accuracy of guaranteeing the order of occurrence can be changed for each event type. For example, when an event for accessing a disk and an event for network communication are acquired, an identifier is assigned and notified only for the event for accessing the disk. In this case, for the event accessing the disk, the logs with the guest OS can be arranged in the order of occurrence with the same accuracy for each event as in the first embodiment. On the other hand, events of network communication can be arranged in the order of event occurrence with the same accuracy as in the second embodiment. As a result, it is possible to accurately determine the time series with the log of the host OS at the time of disk access, and to determine whether network communication has been performed at that time.

Hereinafter, the configuration of the log generation device 9 according to the third embodiment and the processing flow of log generation will be described with reference to FIGS.
FIG. 8 is a diagram illustrating a configuration example of a log generation device according to the third embodiment.
In FIG. 8, the configuration related to the host OS 2 is the same as that of FIG. 2 of the first embodiment, but the configuration related to the guest OS 3 is different, and an identifier arbitration unit 19 is added to the guest OS 3.

  Whether the identifier arbitration unit 19 periodically generates and notifies the identifier by the periodic timer unit 15 at the timing when the identifier should be generated, or whether the guest OS log generation unit 7 generates and notifies the identifier every time the event occurs Make a decision. For example, when the guest OS log generation unit 7 notifies the identifier at a high frequency, the guest OS log generation unit 7 prevents the identifier arbitration unit 19 from notifying the identifier generated by the periodic timer unit 15. It is determined that an identifier is generated / notified every time an event occurs. On the other hand, when the guest OS log generation unit 7 does not frequently notify the identifier, the identifier generated by the guest OS log generation unit 7 is not notified, and the identifier periodically generated by the periodic timer unit 15 is not used. It is determined to be generated / notified.

Next, the operation of the log generation device according to the third embodiment will be described with reference to FIG.
FIG. 9 is a flowchart showing the flow of processing on the guest OS 3 side in the third embodiment.
Note that the processing flow on the host OS 2 side is the same as that of the first embodiment, and thus the description thereof is omitted.

First, in step S501, the cycle timer unit 15 sets a timer. In the timer setting, the log acquisition period is set.
Next, in step S502, the cycle timer unit 15 waits until it is woken up by the cycle interrupt generation unit 18, and when it wakes up, proceeds to the branch of step S503.
Next, in step S <b> 503, the identifier arbitration unit 19 determines whether or not to periodically notify the identifier by the cycle timer unit 15. When the periodic timer unit 15 notifies the identifier periodically, the process proceeds to step S504, and when the periodic timer unit 15 does not periodically notify the identifier, the process skips step S504 and proceeds to step S505.
Next, in step S504, the periodic timer unit 15 notifies the guest OS log generation unit 7 and the virtual machine monitor (VMM) 4 of the host OS 2 of the identifier.
Next, in step S505, the cycle timer unit 15 repeats steps S402 to S403 until a log generation end condition is satisfied. The log generation end condition is, for example, when a preset log acquisition period is satisfied, or when a log acquisition end signal is generated.

Next, the process flow of the guest OS log generation unit 7 will be described.
First, in step S601, the guest OS log generation unit 7 prepares for log generation. Preparation for log generation is the same processing as in the first embodiment.
Next, in step S <b> 602, the guest OS log generation unit 7 stands by until an event for generating a log or an identifier notification from the periodic timer unit 15 is received. If an event for generating a log occurs, the process proceeds to the branch of step S603. If the identifier notification is received from the cycle timer unit 15, the process proceeds to the branch of step S606.
Next, in step S <b> 603, the identifier arbitration unit 19 determines whether the guest OS log generation unit 7 notifies the identifier every time an event occurs. If the guest OS log generation unit 7 notifies the identifier for each event occurrence, the process proceeds to step S604. If the guest OS log generation unit 7 does not notify the identifier for each event occurrence, the process proceeds to step S605.
In step S604, the guest OS log generation unit 7 notifies the identifier generated for each event to the virtual machine monitor (VMM) 4 of the host OS 2 by the identifier notification unit 11.
Next, in step S605, when the guest OS log generation unit 7 determines to notify the identifier in step S603, it outputs the notified identifier and log to the guest OS log 12. On the other hand, if it is determined in step S603 that the identifier is not notified, a log without the identifier is output to the guest OS log 12.
Next, when an identifier notification is received from the periodic timer unit 15 in step S602, the guest OS log generation unit 7 outputs a log to which the identifier is assigned to the guest OS log 12 in step S606.
Next, in step S607, the guest OS log generation unit 7 repeats steps S602 to S607 until a log generation end condition is satisfied. The log generation end condition is, for example, when a preset log acquisition period is satisfied, or when a log acquisition end signal is generated.

  As described above, the invention according to the third embodiment uses the identifier arbitration unit 19 in comparison with the case where the log generation device according to the first and second embodiments is used alone, and the log generation device according to the first and second embodiments. By using together, there is an effect that it is possible to finely adjust the load required for log generation processing and the accuracy for guaranteeing the order of event occurrence.

Embodiment 4 FIG.
In the above first to third embodiments, the guest OS 3 is single. Next, the fourth embodiment shows an embodiment in which there are a plurality of guest OSs 3.

FIG. 10 is a configuration diagram of an information processing apparatus showing an example of the log generation apparatus according to the fourth embodiment.
In FIG. 10, a guest OS 20 and a virtual machine monitor (VMM) 22 that operates the guest OS 20 are additionally provided in the first embodiment. In the fourth embodiment, an example in which one additional unit is arranged has been described. However, two or more units can be arranged, and the maximum number that can be arranged varies depending on the performance of the computer. In the fourth embodiment, the description is based on the first embodiment. However, in the second or third embodiment, a guest OS and a plurality of virtual machine monitors (VMMs) that operate the guest OS are arranged. It is possible. Furthermore, different types of guest OSs may be used.

FIG. 11 is a diagram illustrating a configuration example of a log generation device according to the fourth embodiment.
In FIG. 11, the relationship between the components in the fourth embodiment is substantially the same as that in the first embodiment except that the guest OS 3 and the guest OS 20 are operating. The difference from the first embodiment is that the identifier generating unit 28 needs to generate a unique identifier without duplication between the guest OS 3 and the guest OS 20 in order to operate two units simultaneously. In addition, when there are a plurality of guest OSs as well as two, it is necessary to generate unique identifiers for all guest OSes. The identifiers unique to the plurality of devices can be generated by combining, for example, the computer name + the time in each computer.

  When referring to the identifier embedded in the host OS log 13, the merge unit 6 searches for the identifier from the guest OS log 12 and the guest OS log 26. The individual operations of the other guest OSes and the virtual machine monitor (VMM) are the same as those in FIGS. 4 and 5 of the first embodiment.

  As described above, in addition to the first to third embodiments, the invention of the fourth embodiment is configured such that an identifier is unique among all guest OSes, whereby a plurality of guest OSs and a plurality of virtual machines are provided. Even when the monitor (VMM) is operated, event logs can be arranged in order of occurrence and collected.

1 computer, 2 host OS, 3 guest OS, 4 virtual machine monitor (VMM), 5 host OS log generation unit, 6 merge unit, 7 guest OS log generation unit, 8 event generation unit, 9 log generation device, 10 identifier generation 11 identifier notification unit 12 guest OS log 13 host OS log 14 merge log 15 period timer unit 16 identifier generation unit 17 identifier notification unit 18 period interrupt generation unit 19 identifier arbitration unit 20 guest OS 21 Guest OS log generation unit, 22 Virtual machine monitor (VMM), 23 Event generation unit, 24 Identifier generation unit, 25 Identifier notification unit, 26 Guest OS log

Claims (7)

An identifier generating unit that generates an identifier for uniquely identifying the log of the guest OS;
A guest OS log generation unit that records the identifier generated by the identifier generation unit in a guest OS log in association with a guest OS log;
An identifier notifying unit for notifying the identifier generated by the identifier generating unit;
A host OS log generation unit that records the identifier notified by the identifier notification unit in a host OS log;
A merge unit that extracts a log corresponding to the identifier recorded in the host OS log by the host OS log generation unit from the guest OS log recorded by the guest OS log generation unit and replaces the identifier with the identifier; Log generator. The log generation device according to claim 1, wherein the identifier generation unit generates the identifier every time an event occurs in the guest OS. The log generation device according to claim 1, wherein the identifier generation unit generates the identifier at regular intervals. A first identifier generation unit that generates a first identifier each time an event occurs in the guest OS;
A second identifier generation unit that generates a second identifier at regular intervals;
The log generation device according to claim 1, further comprising: an identifier arbitration unit that determines whether to notify the first identifier or the second identifier according to the occurrence frequency of the event. A first identifier generation unit that generates a first identifier each time an event occurs in the guest OS;
A second identifier generation unit that generates a second identifier at regular intervals;
The log generation device according to claim 1, further comprising: an identifier arbitration unit that determines whether to notify the first identifier or the second identifier according to a type of the event. With multiple guest OSes,
The log generation device according to claim 1, wherein the identifier generation unit generates an identifier for uniquely identifying the logs of the plurality of guest OSs. An identifier generating step for generating an identifier for uniquely identifying the log of the guest OS by the identifier generating unit;
A guest OS log generation step of recording the identifier generated by the identifier generation step by the guest OS log generation unit in a guest OS log in association with a log of the guest OS;
An identifier notifying step for notifying the identifier generated by the identifier generating step by an identifier notifying unit;
A host OS log generation step of recording the identifier notified by the identifier notification step by the host OS log generation unit in a host OS log;
A merge step of extracting a log corresponding to the identifier recorded in the host OS log by the host OS log generation step by the merge unit from the guest OS log recorded by the guest OS log generation step and replacing the identifier with the identifier And a log generation method.

Images