JP6429755B2 - Correlated event extraction program, apparatus and method - Google Patents

Description

  The present invention relates to a technique for investigating relationships among various events that occur.

  In recent years, with the widespread use of ICT (Information and Communication Technologies) systems, a phenomenon in which various types of events occur frequently from one cause often occurs. For example, in a communication system, a large number of events related to a failure occur from a plurality of different devices such as servers and routers due to the occurrence of a communication failure at one location. In this case, if these many events can be correlated at high speed, the cause of the failure can be estimated relatively easily. However, in practice, the relationship between the events that have occurred cannot be clarified, and as a result, it is very difficult to determine the cause of the event.

  For example, Patent Document 1 extracts features from a plurality of events that occur at the time of a system failure, clusters failures based on the features, and determines a cause of failure based on events included in the same failure cluster. A technique for generating rules is proposed. In this technology, search keywords are extracted from the condition phrase of the failure cause determination rule generated based on the event at the time of failure of the same cause included in the same failure cluster, and the recovery procedure manual corresponding to the failure cluster is searched. ing. Next, a failure cause determination rule is generated by combining the searched recovery procedure as an action phrase and combining it with the generated condition phrase.

  Further, for example, Patent Document 2 acquires event data including information on a message sender, a receiver, and a transmission time in a communication event performed by a plurality of different types of communication tools. Discloses a technique for integrated handling of communication event logs.

JP 2011-209908 A JP 2012-141720 A

  However, the conventional techniques as described in Patent Documents 1 and 2 only associate events that occur within a predetermined time range among a plurality of events that occur, and the occurrence times are not necessarily close to each other. It was very difficult to extract events that are related to each other.

  For example, the technique described in Patent Document 1 uses a time window in a predetermined time range and associates synchronization events by including events having a difference in occurrence time within this time window in the same event block. . Therefore, the determination of the relationship between events is bound by the time of occurrence within this time window.

  On the other hand, the technique described in Patent Document 2 also associates a synchronous event by including the attribute of an event that occurred within a predetermined time range before and after the event occurrence time as the base point in the event data. Only.

  As described above, in the related art, only the events that occurred within a predetermined time range before and after the event are associated with each other, for example, other events included in the time range from the start time to the end time of the event are associated. The association based on the inclusion relation cannot be performed. Incidentally, a large number of events that have an inclusion relationship in the time related to such an event, for example, receives a request from the terminal, and the front-end and back-end systems such as servers and network devices cooperate with each other in the terminal. It is generated in many cases in a communication system that sends back a response.

  Therefore, an object of the present invention is to provide a program, an apparatus, and a method capable of extracting events related to each other without being concerned with simple proximity of time related to events.

According to the present invention, there is provided a program for extracting events related to each other, causing a computer mounted on an apparatus capable of acquiring information related to events of different types of event streams to function.
The apparatus has a buffer capable of storing an event identifier of the event and information related to the time of the event,
This program
When the first start event related to the first event stream is acquired, the first event includes the first event identifier of the first start event and the information related to the time of the first start event First event pair registration means for storing a pair in a buffer;
When the second event related to the second event stream is acquired, the second event identifier of the second event and the information related to the time of the second event are stored in the buffer or the buffer An event pair sending means for writing to the first event pair read from, and outputting the first event pair as a second event pair indicating a related event or event candidate;
When the first end event related to the first event stream is acquired, the first event pair stored in the buffer includes an identifier corresponding to the first event identifier of the first end event. A related event extraction program is provided that causes a computer to function as event pair update means for deleting one event pair.

In the related event extracting program according to the present invention, the apparatus further includes a second buffer capable of storing the second event pair,
The program further causes the computer to function as second event pair registration means for storing the output second event pair in the second buffer,
When the event pair update unit obtains the first end event, the event pair update unit selects an identifier corresponding to the first event identifier included in the first end event from the second event pair stored in the second buffer. It is also preferable to write information relating to the time of the first end event to the second event pair including the event pair.

As one embodiment of the related event extraction program according to the present invention, when the event pair sending means acquires the second start event related to the second event stream, the second event included in the second start event. After writing the identifier and the information related to the time of the second start event to the first event pair stored in the buffer or read from the buffer, the first event pair is set to the second event. Output to the second event pair registration means as a pair,
When the event pair update unit obtains the second end event related to the second event stream, the second end event stored in the second buffer has the second end event included in the second event pair. It is also preferable to write information related to the time of the second end event to the second event pair including the identifier corresponding to the event identifier.

  Further, in the embodiment using the second buffer, the event pair update unit obtains the second end event related to the second event stream, and stores the first event pair stored in the second event stream. It is also preferable to delete the first event pair including an identifier corresponding to the second event identifier of the second end event.

  Furthermore, in the embodiment using the second buffer described above, the present program sets the time related to the second event among the second event pairs stored in the second buffer as the first start event. It is also preferable to further cause the computer to function as event pair search means for searching for a second event pair that is between the time and the time related to the first end event. Furthermore, among the second event pair stored in the second buffer, the time related to the second start event and the time related to the second end event are the time related to the first start event and the first end. It is also preferable to further cause the computer to function as event pair search means for searching for a second event pair that is between the time related to the event.

  Further, in the embodiment handling the second start event, the program changes from the time associated with the first start event to the first end event among the second event pairs stored in the second buffer. A second degree in which the degree of superimposition of the time interval up to the time and the time interval from the time related to the second start event to the time related to the second end event is the maximum or equal to or greater than a predetermined threshold It is also preferable to further cause the computer to function as event pair search means for searching for event pairs.

  Furthermore, in the embodiment handling the second start event, the program executes the second event for each first event identifier included in the second event pair stored in the second buffer. For each of the second event identifiers included in the pair, the time interval from the time related to the first start event to the time related to the first end event and the second end event from the time related to the second start event It is also preferable to further cause the computer to function as event pair search means for searching for a second event pair whose degree of overlap with the time interval up to the time related to is the maximum or equal to or greater than a predetermined threshold.

In the embodiment in which the event pair search unit functions, the device further includes a confirmed event pair list registration unit capable of storing the second event pair,
Event pair search means
Store the searched second event pair in the confirmed event pair list registration unit,
During the new search, out of the searched second event pairs, the second registered event pair already stored in the confirmed event pair list registration unit and the first registered in the second registered event pair It is also preferable to exclude the second event pair having an identifier corresponding to at least one of the event identifier and the second event identifier from the search result.

  As another embodiment of the related event extraction program according to the present invention, the event pair sending means obtains the second event identifier of the acquired second event and information related to the time of the second event. The first event identifier and the second event identifier are written in all the first event pairs that match or correspond to each other under a predetermined agreement, and all the first event pairs are output. It is also preferable.

  Furthermore, as another embodiment of the related event extraction program according to the present invention, when the first event pair registration unit stores the first event pair in the buffer, the first event pair registration means is written later with respect to the first event pair. It is also preferable not to reserve a storage area for possible information.

According to the present invention, it is also possible to acquire information related to events of different types of event streams, and to extract events related to each other,
A buffer capable of storing an event identifier of the event and information related to the time of the event;
When the first start event related to the first event stream is acquired, the first event includes the first event identifier of the first start event and the information related to the time of the first start event First event pair registration means for storing a pair in a buffer;
When the second event related to the second event stream is acquired, the second event identifier of the second event and the information related to the time of the second event are stored in the buffer or the buffer An event pair sending means for writing to the first event pair read from, and outputting the first event pair as a second event pair indicating a related event or event candidate;
When the first end event related to the first event stream is acquired, the first event pair stored in the buffer includes an identifier corresponding to the first event identifier of the first end event. A related event extraction apparatus is provided that includes an event pair update unit that deletes one event pair.

According to the present invention, there is further provided a method of extracting events related to each other in an apparatus capable of acquiring information related to events of different types of event streams,
The apparatus has a buffer capable of storing an event identifier of the event and information related to the time of the event,
This method
When the first start event related to the first event stream is acquired, the first event includes the first event identifier of the first start event and the information related to the time of the first start event Storing the pair in a buffer;
When the second event related to the second event stream is acquired, the second event identifier of the second event and the information related to the time of the second event are stored in the buffer or the buffer Writing to the first event pair read from, and outputting the first event pair as a second event pair indicating a related event or event candidate;
When the first end event related to the first event stream is acquired, the first event pair stored in the buffer includes an identifier corresponding to the first event identifier of the first end event. And a related event extracting method including the step of deleting one event pair.

  According to the related event extraction program, apparatus, and method of the present invention, events related to each other can be extracted without being concerned with simple proximity of time related to the event.

It is a functional block diagram which shows the function structure in one Embodiment of the related event extraction apparatus by this invention. It is a typical sequence diagram which shows other embodiment of the related event extraction method by this invention. It is a typical sequence diagram which shows other embodiment of the related event extraction method by this invention. It is a typical sequence diagram which shows other embodiment of the related event extraction method by this invention. It is a typical sequence diagram which shows other embodiment of the related event extraction method by this invention. It is a schematic diagram for demonstrating one Embodiment of the search process implemented in an event pair search part.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a functional block diagram showing a functional configuration in an embodiment of a related event extracting apparatus according to the present invention.

  The related event extraction apparatus 1 according to the present embodiment illustrated in FIG. 1 receives information and information related to the first event from the different types of first event stream and second event stream via the communication interface 101. It is an apparatus that receives information relating to a second event and extracts a first event and a second event that are related to each other.

  Here, in the present embodiment, a time series of various events generated by processing in the front-end system in the communication network can be adopted as the first event stream. On the other hand, as the second event stream, it is possible to employ a time series of various events generated by processing in the back-end system in the same communication network.

In general, in a communication network, a front end and a back end system cooperate with each other to execute, for example, the following processing. That is,
(A) The front-end system receives a request from the terminal, interprets processing to be executed from the request, and requests the back-end system to perform processing.
(B) The back-end system executes the requested processing and returns the processing result to the front-end system.
(C) The front-end system generates a response content to the terminal based on the processing result returned from the back-end system, and returns this response to the terminal.

In such cases,
(A) in the front-end system, one processing A _F Start Event in accordance time at which the start time (the first start time) t _1S, and processing A _F end time is the time of the end event (first End time) _t1E ,
(A) In the back-end system, the start time (second start time) t _2S that is the time related to the start event of the process A _B related to the process A _F and the end that is the time related to the end event of the process A _B The following time inclusion relationship holds between the time (second end time) t _2E .
(1) t _1S ≦ t _2S ≦ t _2E ≦ t _1E

Or, in the back-end system of the above (i), the processing A _F in associated processing A t ₂ the time according to the event start time (start time of the second) is the _B, and inclusion relationship between the time, such as: To establish.
(2) t _1S ≦ t ₂ ≦ t _1E

  Here, specifically, as the event, for example, various events such as the occurrence of an alert, generation of an event log such as a failure, acquisition of various user addresses, acquisition of URL (Uniform Resource Locator), acquisition of user location information, and the like The thing corresponds.

  As described above, the present invention is effective for event streams generated in a communication network system that receives a request from a terminal and cooperates with front-end and back-end systems such as servers and network devices and sends a response back to the terminal. Applies to

  It should be noted that different event streams having the time inclusion relationship as described above are naturally limited to event sequences output from the back-end and front-end systems in the communication network described above. It is not a thing.

  For example, an event stream output from a processing device closer to the user (front end) if the system acquires information from the user or the like in a hierarchical system and returns the processing result to the user. The events in the event stream output from the processing device on the farther side (back end) than the user can take a temporal inclusion relationship. The related event extraction apparatus of the present invention can be applied to such an event stream. In this case, of course, even if systems (devices) that are different event stream generation sources are managed differently independently of each other, related (synchronized) events can be efficiently associated and extracted. It is. As described above, the related event extraction apparatus of the present invention has a wide range of application for event streams to be extracted.

Also in FIG. 1, the related event extracting apparatus 1
(A) an event identifier of the event;
(B) It has the 1st event pair buffer 104 which can memorize | store the information which concerns on the time of the said event. On that basis, the related event extraction apparatus 1 specifically performs a related event extraction process.
(A) When the “first start event” relating to the first event stream is acquired, (a) the first event identifier of the first start event, and (b) the first start event “First event pair” including information related to time is stored in the first event pair buffer 104;
(B) When the “second event” related to the second event stream is acquired, (a) the second event identifier of the second event and (b) the time of the second event Information is written to the “first event pair” stored in the first event pair buffer 104 or read from the first event pair buffer 104, and the first event pair is associated with the related event. Alternatively, it is output as a “second event pair” indicating an event candidate.

Next, the related event extracting apparatus 1 further includes
(C) When the “first end event” related to the first event stream is acquired, among the “first event pair” stored in the first event pair buffer 104, the first end event (A) Delete the first event pair including the identifier corresponding to the first event identifier.

  As described above, the related event extracting apparatus 1 acquires the “first event” and the “second event” from each of the different types of the first event stream and the second event stream, and stores the buffer 104 in the buffer 104. By using this, a “second event pair” including “first event” and “second event” that are related events or related event candidates is generated. Here, when the “first end event” is acquired, the event pair related to the first event stored in the buffer 104 is deleted, so the “first event” which may be related and Only the “second event” can be reliably extracted.

  In addition, in the related event extraction device 1, when generating a “second event pair” indicating a related event or event candidate, it is simply close to the time related to the “first event” (within a predetermined time range). Instead of extracting the “second event” having the time), the event pair is generated in such a way that the time inclusion relationship can be secured. In other words, events related to each other can be extracted without being concerned with the simple proximity of the time related to the event.

  Further, according to the related event extracting apparatus 1, the buffer 104 can be used to search for related (synchronized) events from event streams having different types of event information based on the time inclusion relationship from the event start time to the end time. It is possible to perform extraction in a relatively short processing time using a relatively small storage area. Regarding the processing time related to the search for related (synchronized) events, the search range is narrowed down based on the time inclusion relationship, so that it can be extracted in a relatively short processing time using a relatively small storage area. It becomes possible.

[Functional configuration of the device]
Similarly, according to the functional block diagram shown in FIG. 1, the related event extracting apparatus 1 includes a communication interface 101, a first stream buffer 102, a second stream buffer 103, and a first event pair buffer 104. , A second event pair buffer 105, a confirmed event pair list registration unit 106, a display (DP) 107, and a processor memory. Here, the processor memory realizes a related event extracting function by executing a program that causes the computer of the related event extracting apparatus 1 to function.

  Further, the processor memory includes an event acquisition unit 111, a first event pair registration unit 112, an event pair transmission unit 113, a second event pair registration unit 114, and an event pair update unit as functional components. 115, an event pair search unit 116, and an application 117. Here, the processing flow shown by connecting the functional components of the apparatus 1 in FIG. 1 with arrows is understood as an embodiment of the related event extracting method according to the present invention.

  Also in FIG. 1, the communication interface 101 receives the first event stream and the second event stream via an access network (carrier communication network) or the Internet. Here, the first event stream can be a time series of various logs (events) generated in, for example, a base station (front end) constituting the mobile phone network. Further, the second event stream can be a time series of various logs (events) generated in a server (back end) in a communication network connected to the mobile phone network.

  The first stream buffer 102 and the second stream buffer 103 respectively store the received first event stream and second event stream, and sequentially according to the order of reception or according to other instruction contents, The first event and the second event are output to the event acquisition unit 111.

  The event acquisition unit 111 outputs the input first event and second event to any one of the first event pair registration unit 112, the event pair transmission unit 113, and the event pair update unit 115 according to the contents thereof. .

  Hereafter, the event to be processed has “event identifier” and “event occurrence time (time related to the event)” as components. The first event includes a “first start event” that is an event corresponding to the start of the first event, and a “first end event” that is an event corresponding to the end of the first event. Exists. The “occurrence time” of the first start event is the start time of the first event, and the occurrence time of the first end event is the end time of the first event.

  Further, at least one event exists as the second event. This is the “second start event” or “second end event”. Here, the “occurrence time” of the second start event is the start time of the second event. The “occurrence time” of the second end event is the end time of the second event. Further, it may be an event that occurs at an arbitrary time within a time interval from the start time of the second event to the end time of the second event. Hereinafter, such an event is referred to as a “second intermediate event”. Here, even if this “second intermediate event” is regarded as a “second start event”, the present invention is established. Further, in the case where the “second start event” occurs but the “second end event” does not occur, the present invention is established even if the “second intermediate event” is regarded as the “second end event”. . Further, when the “second start event” does not occur but the “second end event” occurs, the present invention can be realized even if the “second intermediate event” is regarded as the “second start event”. .

  In the embodiment described below, the “second intermediate event” is not used, but the “second start event” and / or the “second end event” is used. In the following description, the start time of the first event, the end time of the first event, the start time of the second event, and the end time of the second event are simply the first start time, Are called end time, second start time, and second end time.

  Further, the “event identifier” may be a number inherently possessed by the communication device / device that is the source of the event (log), for example, a manufacturing number or a MAC (Media Access Control) address. Alternatively, it may be a network address, for example, an IP (Internet Protocol) address or a domain name. Furthermore, the “event identifier” may be an anonymous number obtained as a result of performing the de-identification process on these pieces of information.

  The data type of “occurrence time” may be a date type or a character string type such as 2014/01/01 11:22:33, and is an integer type representing an elapsed time based on a predetermined date and time. May be. The unit of the elapsed time can take an arbitrary time width.

  Incidentally, a first start event and a first end event are input to the first stream buffer 102 each time they occur, and a second start event and a second end event are input to the second stream buffer 103. Is entered whenever it occurs.

  The processing target in the present invention is not limited to two types of event streams. The same processing can be performed for three or more types of event streams. For example, two or more different types of event streams are received from two or more independent devices in the front end, and one or more event streams are received from one or more devices in the corresponding back end for processing. It is also possible to do this.

Hereinafter, in order to describe the function and processing of each functional component, specifically, the event acquisition unit 111 receives the following events IA, IB, and IC from the first stream buffer 102 and the second stream buffer 103. Explain the case. The event is described below in the format of event name <event identifier, occurrence time>.
First start event IA <101, 10:00:00>
Second start event IB <201, 10:00:30>
First end event IC <101, 10:02:30>

As shown in FIG. 1, the event acquisition unit 111
(A) The first start event IA is sent to the first event pair registration unit 112,
(B) The second start event IB is sent to the event pair sending unit 113, and
(C) The first end event IC is output to the event pair update unit 115.

When the first start event IA is input, the first event pair registration unit 112 receives the first event identifier “101” of the first start event IA and the start time (time) of the first start event IA. Information related to 1) First event pair including "10:00:00" (3) IP1 <101, 10:00:00 ,,>
Are stored in the first event pair buffer 104 and registered. Here, when the event pair is completed, it is described in the format of event pair name <first event identifier, first start time, first end time, second event identifier, second start time>. . Incidentally, when the second end event occurs, the completed event pair has an event pair name <first event identifier, first start time, first end time, second event identifier, second It is described in the format of start time, second end time>.

  The first event pair IP1 of the above formula (3) indicates that a storage area (predetermined byte size) for information that may be written later is secured as described above. Has been inserted. In many cases, the processing time or the calculation amount can be shortened by securing the storage area in advance. On the other hand, as this change mode, in order to effectively use the storage capacity resource of the first event pair buffer 104, such a storage area is not reserved in advance, and when the new information is written, the memory for that amount is stored. It is also preferable to expand the area.

When the event pair sending unit 113 acquires the second start event IB, the second event identifier “201” of the second event IB and the start time of the second event IB (information relating to time) ” 10:00:30 "is written (assigned) to the first event pair IP1 of the above equation (3) stored in or read from the first event pair buffer 104, The written first event pair, that is, the second event pair indicating the related event or event candidate (4) IP2 <101, 10:00:00, 201, 10:00:30>
Is output to the second event pair registration unit 114.

  Here, the first event identifier and the second event identifier are generated under the same identifier number system, and whether or not the first event identifier and the second event identifier match (the same occurrence). Consider a case where a method for determining whether or not to indicate a source is known. At this time, the event pair sending unit 113 substitutes the second event identifier and the second start time in all event pairs in which the first event identifier and the second event identifier match, and these event pairs May be output to the second event pair registration unit 114.

  For example, it is known that an event identifier is generated under a numbering system that indicates the same source if the last two digits of the first event identifier and the last two digits of the second event identifier are the same. Think about the case. For example, in the embodiment shown in the above equations (3) and (4), the last two digits of the second event identifier “201” are “01”, and the first event identifier of the first event pair IP1 Since it matches the lower two digits “01” of “101”, the same second event pair as the above equation (4) is output to the second event pair registration unit 114. Of course, the method for determining whether or not the first event identifier and the second event identifier match is not limited to the above-described method. For example, there is a method of determining that all digits match, or a method of determining whether or not a match is prepared based on a correspondence table of first event identifiers and second event identifiers separately prepared. It may be adopted.

  The second event pair registration unit 114 registers the input second event pair IP2 of the above equation (4) by storing it in the second event pair buffer 105.

  When the event pair update unit 115 acquires the first end event IC, the first event identifier included in the first end event IC among the first event pairs stored in the first event pair buffer 104 is acquired. The first event pair including “101” (or an identifier corresponding to this identifier), here, the first event pair IP1 of the above equation (3) is deleted.

Furthermore, when the event pair update unit 115 acquires the first end event IC, the event pair update unit 115 includes a second event identifier “101” (or an identifier corresponding to this identifier) included in the first end event IC. The end time (information relating to the time) of the first end event IC is written (substituted) into the event pair, here, the second event pair IP2 of the above formula (4). As a result, the second event pair IP2 has the following formula (5) IP2 <101, 10:00:00, 10:02:30, 201, 10:00:30>
become that way.

  Incidentally, in the embodiment in which the device 1 also receives the second end event as described later, when the event pair update unit 115 acquires the second end event related to the second event stream, Among the second event pairs stored in the event pair buffer 105, the second event pair including the second event identifier (or an identifier corresponding to the identifier) of the second end event is obtained. Write (substitute) the end time (information related to the time) of the second end event.

Next, the event pair search unit 116 determines that the time (start time) t ₂ related to the second start event IB among the second event pairs stored (registered) in the second event pair buffer 105 is the first. It is between the time (start time) t _1S related to the start event and the time (end) t _1E related to the first end event, that is, the above equation (2) t _1S ≦ t ₂ ≦ t _A second event pair that satisfies the _1E relationship, where t ₂ (= 10: 00: 30) is between t _1S (= 10: 00: 00) and t _1E (= 10: 02: 30) The second event pair IP2 of the above equation (5) is searched (extracted).

Incidentally, in the embodiment in which the device 1 also receives the second end event as described later, the event pair search unit 116 selects the second event pair stored in the second buffer from the second event pair. The time (start time) t _2S related to the start event and the time (end time) t _2E related to the second end event are related to the time (start time) t _1S related to the first start event and the first end event. Search (extract) a second event pair that is between time (end) t _1E , that is, satisfy the relationship of the above formula (1) t _1S ≦ t _2S ≦ t _2E ≦ t _1E To do.

  Similarly, in FIG. 1, the confirmed event pair list registration unit 106 stores and registers the second event pair searched (extracted) by the event pair search unit 116. The information related to the second event pair searched by the event pair search unit 116 or registered in the confirmed event pair list registration unit 106, that is, information related to mutually related events (synchronous event information), for example, uses the application 117. It is also preferable that the information is displayed on the display 107 in a predetermined format and provided to the user of the information. Further, the related (synchronous) event information is not shown, but may be transmitted to an external information processing apparatus via the communication interface 101 and provided to the user by the apparatus.

The processing procedure for the first start event IA, the second start event IB, and the first end event IC described above is a typical form of the related event extraction program and method of this embodiment. In this process, the valid period of the first event pair relating to the specific event identifier is between the start time of the first start event and the end time of the first end event, and the first event pair that arrived during this period A second event pair is generated only between two start events and registered in the second event pair buffer 105. By such a process, in the second event pair, the following condition is satisfied in principle: first start time ≦ second start time ≦ second end time.

  However, as an exception, the second start time may be earlier than the first start time due to the time difference between the inputs to the first stream buffer 102 and the second stream buffer 103, or the second There may be a case where the time order is wrong, for example, the start time of is behind the first end time. In this case, as will be described later, the event pair search unit 116 selects the second event pair having the above-described correct time order, and the problem of this misplacement is solved.

  Next, an embodiment in which the related event extracting apparatus 1 receives the second end event will be described.

  2 to 5 are schematic sequence diagrams showing other embodiments of the related event extracting method according to the present invention.

Hereinafter, processing when the following events E1 to E20 are sequentially input to the first stream buffer 102 and the second stream buffer 103 will be described. Here, the events E1 to E8 are an event sequence of an input example showing a typical processing procedure in consideration of the second end event. Further, events E9 to E14 are an event sequence of an input example showing a processing procedure for narrowing down a plurality of second event pairs and searching for (extracting) related (synchronous) events. Further, the events E15 to E20 are an example of an event string indicating a processing procedure that does not include the already determined event pair in the new search result of the event pair in an overlapping manner.
First start event E1 <101, 10:00:00>
Second start event E2 <201, 10:00:30>
Second end event E3 <201, 10:02:00>
First end event E4 <101, 10:02:30>
First start event E5 <101, 10:03:00>
Second start event E6 <202, 10:03:15>
First end event E7 <101, 10:03:30>
Second end event E8 <202, 10:03:45>
First start event E9 <102, 10:05:00>
First start event E10 <103, 10:06:00>
Second start event E11 <202, 10:06:30>
First end event E12 <102, 10:08:00>
Second end event E13 <202, 10:08:00>
First end event E14 <103, 10:08:30>
First start event E15 <103, 10:10:00>
Second start event E16 <202, 10:10:00>
Second start event E17 <203, 10:10:45>
Second end event E18 <202, 10:11:30>
Second end event E19 <203, 10:11:45>
First end event E20 <103, 10:12:00>

[Processing of events E1 to E8]
First, as shown in FIG. 2, when the first start event E1 arrives, the first event pair registration unit 112 stores the new first event pair 1-1 in the first event pair buffer 104. Register.
(6) 1-1 <101, 10:00:00 ,,,>

Next, when the second start event E2 arrives, the event pair sending unit 113 substitutes the second event identifier and the second start time of the event E2 for the first event pair 1-1. The first event pair 1-1 is sent to the second event pair registration unit 114 as a second event pair. The second event pair registration unit 114 outputs the new event pair to the second event pair buffer 105 and registers it.
(7) 2-1-1 <101, 10:00:00, 201, 10:00:30,>

Next, when the second end event E3 arrives, the event pair update unit 115 substitutes the second end time of the event E3 for the second event pair 2-1-1.
(8) 2-1-2 <101, 10:00:00, 201, 10:00:30, 10:02:00>

Next, when the first end event E4 arrives, the event pair update unit 115 has the first event identifier “101” of the event E4 among the event pairs stored in the first event pair buffer 104. Event pair 1-1 (formula (6)) is deleted. Further, the first end time of the event E4 is substituted for the second event pair 2-1-2.
(9) 2-1-3 <101, 10:00:00, 10:02:30, 201, 10:00:30, 10:02:00>

Next, as shown in FIG. 3, when the first start event E5 arrives, the first event pair registration unit 112 stores a new first event pair 1-2 in the first event pair buffer 104. Register.
(10) 1-2 <101,10: 03: 00 ,,,>

Next, when the second start event E6 arrives, the event pair sending unit 113 substitutes the second event identifier and the second start time of the event E6 for the first event pair 1-2. The first event pair 1-2 is sent to the second event pair registration unit 114 as a second event pair. The second event pair registration unit 114 outputs the new event pair to the second event pair buffer 105 and registers it.
(11) 2-2-1 <101, 10:03:00, 202, 10:03:15,>

Next, when the first end event E7 arrives, the event pair update unit 115 has the first event identifier “101” of the event E7 among the event pairs stored in the first event pair buffer 104. Event pair 1-2 (formula (10)) is deleted. Further, the first end time of the event E7 is substituted for the second event pair 2-2-1.
(12) 2-2-2 <101, 10:03:00, 10:03:30, 202, 10:03:15,>

Next, when the second end event E8 arrives, the event pair update unit 115 assigns the second end time of the event E8 to the second event pair 2-2-2.
(13) 2-2-3 <101, 10:03:00, 10:03:30, 202, 10:03:15, 10:03:45>

[Processing of events E9 to E14]
First, as shown in FIG. 4, when the first start event E9 arrives, the first event pair registration unit 112 stores the new first event pair 1-3 in the first event pair buffer 104. Register.
(14) 1-3 <102, 10:05:00, ...

Next, when another new first start event E10 arrives, the first event pair registration unit 112 registers the new first event pair 1-4 in the first event pair buffer 104.
(15) 1-4 <103, 10:06:00, ...

Next, when the second start event E11 arrives, the event pair sending unit 113 sends the second event identifier of the event E11 to each of the first event pair 1-3 and the first event pair 1-4. And the second start time are substituted, and these first event pairs are sent to the second event pair registration unit 114 as second event pairs. The second event pair registration unit 114 outputs and registers these new event pairs to the second event pair buffer 105.
(16) 2-3-1 <102, 10:05:00, 202, 10:06:30,>
(17) 2-4-1 <103, 10:06:00, 202, 10:06:30,>

Next, when the first end event E12 arrives, the event pair update unit 115 has the first event identifier “102” of the event E12 among the event pairs stored in the first event pair buffer 104. Event pair 1-3 (the above formula (14)) is deleted. Further, the first end time of the event E12 is substituted for the second event pair 2-3-1 having the first event identifier “102”.
(18) 2-3-2 <102, 10:05:00, 10:08:00, 202, 10:06:30,>

  For example, when two or more first event pairs having the first event identifier of the arrived first end event are stored in the buffer 104, these first events are taken as one example. It is also preferable to delete the pair with the earliest first start time.

Next, when the second end event E13 arrives, the event pair update unit 115 performs the second event E13 on the second event pair 2-3-2 and the second event pair 2-4-1. Substitute end time.
(19) 2-3-3 <102, 10:05:00, 10:08:00, 202, 10:06:30, 10:08:00>
(20) 2-4-2 <103, 10:06:00, 202, 10:06:30, 10:08:00>

  Here, when the second end event E13 arrives, the event pair update unit 115 selects an identifier corresponding to the second event identifier included in the second end event from the stored first event pair. The included first event pair may be deleted. By executing this process, the first event pair is deleted from the first event pair buffer by reflecting the earlier one of the end times corresponding to the first event identifier and the second event identifier. can do.

Here, in order to execute this deletion process, as a premise, when the second start event arrives, for example, as shown in the following equation (15 ′), the second event identifier and the second start time are It is indispensable to be written in the “first event pair” stored in the first event pair buffer 104 or read from the first event pair buffer 104.
(15 ') 1-4 <103, 10:06:00, 202, 10:06:30,>
Under this assumption, when the second end event E13 arrives before the first end event E14 arrives, the event pair update unit 115 stores the event pair stored in the first event pair buffer 104. Of these, the event pair 1-4 (the above expression (15 ′)) having the second event identifier “202” in the event E13 can be quickly deleted.

  For example, when two or more first event pairs having the second event identifier of the second end event that has arrived are stored in the buffer 104, these first events are taken as an example. It is also preferable to delete the pair with the earliest second start time.

Next, when the first end event E14 arrives, the event pair update unit 115 has the first event identifier “103” of the event E14 among the event pairs stored in the first event pair buffer 104. Event pair 1-4 (the above formula (15)) is deleted. Further, the first end time of the event E14 is substituted for the second event pair 2-4-2.
(21) 2-4-3 <103, 10:06:00, 10:08:30, 202, 10:06:30, 10:08:00>

[Processing of events E15 to E20]
First, as shown in FIG. 5, when the first start event E15 arrives, the first event pair registration unit 112 stores the new first event pair 1-5 in the first event pair buffer 104. Register.
(22) 1-5 <103, 10:10:00, ...

Next, when the second start event E16 arrives, the event pair sending unit 113 substitutes the second event identifier and the second start time of the event E16 for the first event pair 1-5. The first event pair 1-5 is sent to the second event pair registration unit 114 as a second event pair. The second event pair registration unit 114 outputs the new event pair to the second event pair buffer 105 and registers it.
(23) 2-5-1 <103, 10:10:00, 202, 10:10:00,>

Next, when another new second start event E17 arrives, the event pair sending unit 113 sets the second event identifier and the second start time of the event E17 to the first event pair 1-5. The first event pair 1-5 is sent to the second event pair registration unit 114 as a second event pair. The second event pair registration unit 114 outputs the new event pair to the second event pair buffer 105 and registers it.
(24) 2-6-1 <103, 10:10:00, 203, 10:10:45,>

Next, when the second end event E18 arrives, the event pair update unit 115 substitutes the second end time of the event E18 for the second event pair 2-5-1.
(25) 2-5-2 <103, 10:10:00, 202, 10:10:00, 10:11:30>

Next, when the second end event E19 arrives, the event pair update unit 115 assigns the second end time of the event E19 to the second event pair 2-6-1.
(26) 2-6-2 <103, 10:10:00, 203, 10:10:45, 10:11:45>

Next, when the first end event E20 arrives, the event pair update unit 115 has the first event identifier “103” of the event E20 among the event pairs stored in the first event pair buffer 104. Event pair 1-5 (formula (22)) is deleted. Further, the first end time of the event E20 is assigned to the second event pair 2-5-2 and the second event pair 2-6-2.
(27) 2-5-3 <103, 10:10:00, 10:12:00, 202, 10:10:00, 10:11:30>
(28) 2-6-3 <103, 10:10:00, 10:12:00, 203, 10:10:45, 10:11:45>

  Hereinafter, an embodiment of processing for searching (extracting) a related (synchronous) event from completed event pairs registered in the second event pair buffer 105 by the event processing described above will be described.

[Event Pair Search]
First, a search for an event pair at the stage where the processing of the second end event E8 is completed will be described. At this stage, the second event pair buffer 105 contains
2-1-3 <101, 10:00:00, 10:02:30, 201, 10:00:30, 10:02:00>
2-2-3 <101, 10:03:00, 10:03:30, 202, 10:03:15, 10:03:45>
Is registered. The event pair search unit 116 (FIG. 1)
t _1S ≦ t _2S ≦ t _2E ≦ t _1E (Formula (1))
A second event pair that satisfies the above relationship is searched (extracted). Here, t _1S , t _2S , t _2E, and t _1E are a first start time, a second start time, a second end time, and a first end time, respectively.

  The event pair search unit 116 searches (extracts) the event pair 2-1-3 because the event pair 2-1-3 satisfies the above formula (1).

Next, an event pair search process at the stage where the process of the second end event E14 is completed will be described. At this stage, the second event pair buffer 105 contains
2-1-3 <101, 10:00:00, 10:02:30, 201, 10:00:30, 10:02:00>
2-2-3 <101, 10:03:00, 10:03:30, 202, 10:03:15, 10:03:45>
2-3-3 <102, 10:05:00, 10:08:00, 202, 10:06:30, 10:08:00>
2-4-3 <103, 10:06:00, 10:08:30, 202, 10:06:30, 10:08:00>
Is registered. Among these, three event pairs 2-1-3, 2-3-3, and 2-4-3 satisfy the above formula (1) t _1S ≦ t _2S ≦ t _2E ≦ t _1E .

  Here, in addition to the search condition 1 of the above formula (1), a search condition 2 described below is further set.

  FIG. 6 is a schematic diagram for explaining an embodiment of a search process performed by the event pair search unit 116.

According to FIG. 6, t _1S , t _2S , t _2E and t _1E are respectively _defined as a first start time, a second start time, a second end time and a first end time,
_{(A) T1 = t 1E -t} 1S, (b) T2 = t 1E -t 2S,
_{(C) T3 = t 2E -t} 2S, (d) T4 = t 2E -t 1S
As a search condition 2,
(29) T2 / T1 is a maximum or a predetermined threshold or more,
(30) T3 / T1 is maximum or above a predetermined threshold, or (31) T4 / T1 is maximum or above a predetermined threshold, or (32) T3 / T2 is maximum or above a predetermined threshold, or (33) ) It is mentioned that T3 / T4 is maximum or above a predetermined threshold. This is because the event pair search unit 116 (FIG. 1) starts from the time (start time t _1S ) related to the first start event among the second event pairs stored in the second event pair buffer 105. The time interval until the time related to the end event (end time t _1E ) and the time from the time related to the second start event (start time t _2S ) to the time related to the second end event (end time t _2E ) This means searching for a second event pair whose degree of overlap with the interval is the maximum or equal to or greater than a predetermined threshold.

In this embodiment, “T2 / T1 is the maximum” in the above equation (29) is adopted as the search condition 2. Here, when T2 / T1 is calculated for the three event pairs 2-1-3, 2-3-3 and 2-4-3 extracted as satisfying the search condition 1,
2-1-3: 120 (seconds) / 150 (seconds) = 0.8
2-3-3: 90 (seconds) / 180 (seconds) = 0.5
2-4-3: 120 (seconds) / 150 (seconds) = 0.8
It becomes. Since the event pair 2-1-3 and 2-4-3 has the maximum T2 / T1, the event pair 2-1-3 and the event pair 2-4-3 are searched.

Event pairs 2-1-3 and 2-4-3 searched for satisfying the search conditions 1 and 2 are registered in the confirmed event pair list registration unit 106 (FIG. 1).
2-1-3 <101, 10:00:00, 10:02:30, 201, 10:00:30, 10:02:00>
2-4-3 <103, 10:06:00, 10:08:30, 202, 10:06:30, 10:08:00>

Next, a search for an event pair at the stage where the processing of the second end event E20 is completed will be described. At this stage, event pairs 2-3-3, 2-4-3, 2-5-3 and 2-6-3 are registered in the second event pair buffer 105. 2 event pair buffer 105
2-1-3 <101, 10:00:00, 10:02:30, 201, 10:00:30, 10:02:00>
2-2-3 <101, 10:03:00, 10:03:30, 202, 10:03:15, 10:03:45>
2-3-3 <102, 10:05:00, 10:08:00, 202, 10:06:30, 10:08:00>
2-4-3 <103, 10:06:00, 10:08:30, 202, 10:06:30, 10:08:00>
2-5-3 <103, 10:10:00, 10:12:00, 202, 10:10:00, 10:11:30>
2-6-3 <103, 10:10:00, 10:12:00, 203, 10:10:45, 10:11:45>
Is registered.

Among these, it is event pairs 2-1-3, 2-3-3, 2-4-3 that satisfy t _1S ≦ t _2S ≦ t _2E ≦ t _1E (formula (1)) as the search condition 1. 2-5-3 and 2-6-3.

  Further, among those satisfying these search conditions 1, event pairs 2-1-3 and 2-4-3 are already registered in the confirmed event pair list registration unit 106 as confirmed event pairs as described above.

(When the confirmed event pair is not considered in the event pair search unit 116)
Here, a case will be described in which the search is performed without considering the confirmed event pair in the search processing in the event pair search unit 116. In this case, calculating T2 / T1 for event pairs 2-1-3, 2-3-3, 2-4-3, 2-5-3 and 2-6-3,
2-1-3: 120 (seconds) / 150 (seconds) = 0.8
2-3-3: 90 (seconds) / 180 (seconds) = 0.5
2-4-3: 120 (seconds) / 150 (seconds) = 0.8
2-5-3: 120 (seconds) / 120 (seconds) = 1.0
2-6-3: 75 (seconds) / 120 (seconds) = 0.625
It becomes. Since the event pair 2-5-3 has the maximum T2 / T1, the event pair 2-5-3 is searched.

(When the event pair search unit 116 uses the first event identifier or the second event identifier as a search key)
Further, a case where the first event identifier or the second event identifier is used as a search key in the search processing in the event pair search unit 116 will be described. In this case, the search condition 2 may not be applied to the entire second event pair buffer 105 but may be applied to each of the first event identifiers in the second event pair buffer 105. That is, when the above formula (29) is adopted as the search condition 2, the second event pair “T2 / T1 is maximum” is searched for each of the first event identifiers in the second event pair buffer 105. Also good. In this case, in the above-described embodiment, since the first event identifiers in the second event pair buffer 105 are 101, 102, and 103, the second event pair “T2 / T1 is maximum” for each of them. As a result, 2-1-3, 2-3-3 and 2-5-3 are retrieved. As a change mode, the search condition 2 may be applied to each of the second event identifiers in the second event pair buffer 105. In this case, the same processing as described above is performed. . For example, in the embodiment described above, the second event identifiers in the second event pair buffer 105 are 201, 202, and 203, so that each of the second event pairs “T2 / T1 is the maximum” , 2-1-3, 2-4-3 and 2-5-3 are searched.

Next, in the above-described embodiment, the event pair search unit 116 (FIG. 1) stores the searched second event pair in the confirmed event pair list registration unit 106 and performs a search when performing a new search. Of the second event pair
(A) a second registered event pair already stored in the confirmed event pair list registration unit 106; and (b) at least a first event identifier and a second event identifier included in the second registered event pair. A second event pair having an identifier corresponding to one is excluded from the search results.

Specifically, since event pairs 2-1-3 and 2-4-3 are already registered,
(A) Event pair 2-1-3 and 2-4-3;
(B) including any one of the first event identifiers “101” and “102” and the second event identifiers “201” and “202” constituting the event pairs 2-1-3 and 2-4-3 The event pairs 2-2-3, 2-3-3 and 2-5-3 are excluded from the search results. As a result, event pair 2-6-3
2-6-3 <103, 10:10:00, 10:12:00, 203, 10:10:45, 10:11:45>
Is searched.

This
(A) The first event (identifier “103”) indicated by the first start event E15 and the first end event E20, and the second event indicated by the second start event E17 and the second end event E19. The event (identifier “203”) is determined to be an event related to each other.

(Exclusion condition that refers to only one of the first event identifier and the second event identifier in the confirmed event pair list)
The event pair search unit 116 (FIG. 1) replaces the above (b) as an exclusion condition.
(B ′) a second event pair having an identifier corresponding to the first event identifier included in the second registered event pair, or (b ″) a second event pair included in the second registered event pair. A second event pair having an identifier corresponding to the event identifier may be employed.

Here, since the event pairs 2-1-3 and 2-4-3 are already registered in the confirmed event pair list registration unit 106,
(A) a first event (identifier “101”) indicated by a first start event E1 and a first end event E4, and a second event indicated by a second start event E2 and a second end event E3 The event (identifier “201”) is determined to be an event related to each other, and
(C) the first event (identifier “103”) indicated by the first start event E10 and the first end event E14, and the second event indicated by the second start event E11 and the second end event E13. The event (identifier “202”) is determined to be an event related to each other.

  As described above in detail, according to the related event extraction program, apparatus, and method of the present invention, the first event and the second event from the different types of the first event stream and the second event stream, respectively. And a buffer is used to generate an event pair that is a related event or a related event candidate. In addition, when generating such an event pair, the second event having a time close to the time related to the first event is not simply extracted, but the inclusion relationship of time can be secured. The event pair is generated with. As a result, events related to each other can be extracted without being concerned with the simple proximity of the time related to the event.

  Furthermore, related (synchronized) events can be extracted in a relatively short processing time by using a relatively small storage area called a buffer. In other words, event pairs that do not satisfy the event time inclusion relationship are controlled so as not to be registered in the buffer, so that a small storage area is required. Further, when searching for an event pair, only the event pair registered in the buffer is set as a search target, so that the search processing time can be shortened.

  Incidentally, as different information sources that cause the first event stream and the second event stream, there are a plurality of positioning means with different accuracy and granularity in the output position information, a storefront system and a backbone system, and an authentication server. And various forms such as an application server and a database managed by a plurality of different operators. Of these, even when the servers such as the authentication server and the application server are constructed under different management, according to the present invention, these servers are analyzed in an integrated manner for the purpose of, for example, marketing or failure handling. be able to. Furthermore, according to the present invention, for example, a suitable recommendation service is provided or the cause of a failure in which the occurrence location is difficult to identify is analyzed by examining the linkage (association) between a plurality of business operators' databases. It is also possible.

  Further, according to the present invention, as one embodiment, IDs (identifiers) of event logs in different types of devices / systems can be linked to quickly search for IDs to be synchronized. Thereby, for example, IDs between communication services can be linked, or network devices can be linked. Furthermore, even in the field of IoT (Internet of Things), which is expected to make great progress in the future, research on the relevance of information output from a large number of devices and devices is relatively short using a relatively small storage area. It becomes possible to process in time.

  Various changes, modifications, and omissions of the various embodiments of the present invention described above within the scope of the technical idea and the viewpoint of the present invention can be easily made by those skilled in the art. The above description is merely an example, and is not intended to be any limitation. The present invention is limited only by the claims and the equivalents thereof.

DESCRIPTION OF SYMBOLS 1 Related event extraction apparatus 101 Communication interface 102 1st stream buffer 103 2nd stream buffer 104 1st event pair buffer 105 2nd event pair buffer 106 Confirmed event pair list registration part 107 Display (DP)
111 Event acquisition unit 112 First event pair registration unit 113 Event pair transmission unit 114 Second event pair registration unit 115 Event pair update unit 116 Event pair search unit 117 Application

Claims (13)

A program for extracting events related to each other, causing a computer mounted on an apparatus capable of acquiring information related to events of different types of event streams to function.
The device has a buffer capable of storing an event identifier of the event and information related to the time of the event,
The program is
When the first start event related to the first event stream is acquired, the first event includes the first event identifier of the first start event and the information related to the time of the first start event First event pair registration means for storing a pair in the buffer;
When the second event related to the second event stream is acquired, the second event identifier of the second event and the information related to the time of the second event are stored in the buffer or Event pair sending means for writing the first event pair read from the buffer and outputting the first event pair as a second event pair indicating a related event or event candidate;
When the first end event related to the first event stream is acquired, an identifier corresponding to the first event identifier of the first end event is included in the first event pair stored in the buffer. A related event extraction program for causing a computer to function as an event pair update means for deleting a first event pair. The apparatus further includes a second buffer capable of storing the second event pair,
The program further causes the computer to function as second event pair registration means for storing the output second event pair in the second buffer,
The event pair update unit corresponds to the first event identifier of the first end event among the second event pairs stored in the second buffer when the first end event is acquired. The related event extraction program according to claim 1, wherein information related to the time of the first end event is written into a second event pair including an identifier. When the event pair sending means acquires the second start event related to the second event stream, the second event identifier of the second start event and the information related to the time of the second start event Are written in the first event pair stored in the buffer or read from the buffer, and the first event pair is output as the second event pair to the second event pair registration means. And
The event pair update unit obtains the second end event of the second end event stored in the second buffer when the second end event related to the second event stream is acquired. The related event extraction program according to claim 2, wherein information related to the time of the second end event is written to a second event pair including an identifier corresponding to the event identifier of 2.   The event pair update unit corresponds to the second event identifier of the second end event among the stored first event pairs when the second end event related to the second event stream is acquired. The related event extraction program according to claim 2 or 3, wherein the first event pair including the identifier to be deleted is deleted.   Of the second event pair stored in the second buffer, the time related to the second event is between the time related to the first start event and the time related to the first end event. The related event extraction program according to any one of claims 2 to 4, further comprising a computer functioning as event pair search means for searching for a second event pair.   Of the second event pair stored in the second buffer, the time related to the second start event and the time related to the second end event are the time related to the first start event and the first end event. 4. The related event extraction program according to claim 3, further comprising a computer functioning as event pair search means for searching for a second event pair that falls between such times.   Of the second event pair stored in the second buffer, the time interval from the time related to the first start event to the time related to the first end event, and the second from the time related to the second start event. The computer is further caused to function as event pair search means for searching for a second event pair whose degree of overlap with the time interval up to the time related to the end event is maximum or equal to or greater than a predetermined threshold. The related event extraction program according to claim 3 or 6.   For each of the first event identifiers included in the second event pair stored in the second buffer, or for each of the second event identifiers included in the second event pair, the first start event The degree of superimposition of the time interval from the time related to the time related to the first end event and the time interval from the time related to the second start event to the time related to the second end event is the maximum or predetermined The related event extraction program according to claim 3 or 6, further comprising a computer functioning as event pair search means for searching for a second event pair that is equal to or greater than a threshold value. The apparatus further includes a confirmed event pair list registration unit capable of storing a second event pair,
The event pair search means includes:
Storing the searched second event pair in the confirmed event pair list registration unit;
In a new search, out of the searched second event pairs, the second registered event pair already stored in the confirmed event pair list registration unit, and the first registered in the second registered event pair 9. The association according to claim 5, wherein a second event pair having an identifier corresponding to at least one of the event identifier and the second event identifier is excluded from the search result. Event extraction program.   The event pair sending means includes a second event identifier of the acquired second event and information related to the time of the second event, wherein the first event identifier and the second event identifier are predetermined. 10. All the first event pairs are output after writing to all the first event pairs that match or correspond under the agreement of claim 1. Related event extraction program described in 1.   When the first event pair registration unit stores the first event pair in the buffer, the first event pair registration unit does not reserve a storage area for information that may be written later to the first event pair. The related event extraction program according to claim 1, wherein: It is a device that can acquire information related to events of different types of event streams and extracts events related to each other,
A buffer capable of storing an event identifier of the event and information related to the time of the event;
When the first start event related to the first event stream is acquired, the first event includes the first event identifier of the first start event and the information related to the time of the first start event First event pair registration means for storing a pair in the buffer;
When the second event related to the second event stream is acquired, the second event identifier of the second event and the information related to the time of the second event are stored in the buffer or Event pair sending means for writing the first event pair read from the buffer and outputting the first event pair as a second event pair indicating a related event or event candidate;
When the first end event related to the first event stream is acquired, an identifier corresponding to the first event identifier of the first end event is included in the first event pair stored in the buffer. An associated event extracting apparatus comprising: an event pair updating unit that deletes the first event pair. A method for extracting events related to each other in an apparatus capable of acquiring information related to events of different types of event streams,
The device has a buffer capable of storing an event identifier of the event and information related to the time of the event,
The method
When the first start event related to the first event stream is acquired, the first event includes the first event identifier of the first start event and the information related to the time of the first start event Storing a pair in the buffer;
When the second event related to the second event stream is acquired, the second event identifier of the second event and the information related to the time of the second event are stored in the buffer or Writing to the first event pair read from the buffer, and outputting the first event pair as a second event pair indicating a related event or event candidate;
When the first end event related to the first event stream is acquired, an identifier corresponding to the first event identifier of the first end event is included in the first event pair stored in the buffer. And deleting the first event pair. A related event extracting method comprising:

Images