JP6502889B2 - Log information search system and log information search method - Google Patents

Description

  The present invention relates to a log information search system and a log information search method for searching log information.

  Conventionally, in a system in which a plurality of server devices in a data center provide a web service to a user terminal device, log information collection functions have been deployed as resident processes in the plurality of server devices. The log information generated in the server apparatus is stored in the server apparatus itself and is collected in a database in the log collecting server apparatus provided exclusively for the log information. And the database in a log collection server apparatus was used for the analysis of the log information of a specific user terminal device (refer nonpatent literature 1 and 2).

What is "Integrated Log Management System Logstorage Integrated Log Management", [online], Infoscience Corporation, [May 17, 2016 search], Internet (URL: http://www.logstorage.com/product/) "Computer security log management guide", [online], independent administrative corporation information processing promotion mechanism, [May 17, 2016 search], Internet (URL: http://www.ipa.go.jp/files/000025363 .pdf)

  In recent years, the amount of log information generated in a data center tends to increase with the increase in the number of server devices in the data center, the improvement of the processing capacity, and the like. In this case, the data copy for collecting log information increases the traffic volume of the network, and a large consumption of network bandwidth occurs. In addition, a large storage capacity is required to accumulate log information.

  The present invention has been made in view of the above circumstances, and a log information search system and a log information search method capable of suppressing an increase in traffic of a network and an increase in storage capacity required for log information. The challenge is to provide

  In order to solve the above problems, a log information search system according to the present invention searches log information for searching log information related to the user terminal device in a network communicably connecting the user terminal device and a plurality of server devices. A system comprising: a plurality of transfer devices provided in the network and configuring a route between the user terminal device and the server device; and a maintenance terminal device, wherein the server device is the user terminal The log information on the device is stored, and the transfer device stores the correspondence between the key information of the user terminal device and the route information on the route between the user terminal device and the server device, and the maintenance terminal The device is configured such that the server accessed by the user terminal device using the correspondence stored in the transfer device Identify location, characterized by collecting the log information on the user terminal device stored in the server device identified.

  According to this configuration, it is possible for each transfer device to search for log information stored in each server device by storing route information. Therefore, it is possible to eliminate the need for the log collection server dedicated to the log information, and to suppress the increase in the traffic volume of the network and the increase in the storage capacity required for the log information.

  The maintenance terminal apparatus is accessed by the user terminal apparatus by sequentially inquiring the route from the upstream transfer apparatus on the user terminal apparatus side to the downstream transfer apparatus on the server apparatus side. The server device may be specified.

  According to this configuration, since the route is sequentially inquired from the upper transfer apparatus, the server apparatus accessed by the user terminal apparatus can be suitably identified.

  The transfer device may be configured to store the correspondence based on the packet when the packet passes through the transfer device.

  According to this configuration, the information of the user terminal that has accessed at the time of the packet passage, that is, the correspondence is stored, so that all routes of the user terminal can be searched by referring to the correspondence at the time of route search.

  The transfer device may be configured to hash the key information included in the correspondence relationship.

  According to this configuration, since the key information is hashed, size reduction and high-speed search of the key information can be realized.

  Further, a log information search method according to the present invention is a log information search method in a log information search system for searching log information related to a user terminal device in a network communicably connecting a user terminal device and a plurality of server devices. The log information search system is provided in the network, and includes a plurality of transfer devices that form a route between the user terminal device and the server device, and a maintenance terminal device. The server device stores log information related to the user terminal device, and the transfer device correlates key information of the user terminal device with route information related to a route between the user terminal device and the server device. The maintenance terminal device stores the user terminal device using the correspondence relationship stored in the transfer device. The server device identification step of identifying the server device accessed by the server, and the log information collection step of collecting log information on the user terminal device stored in the server device identified by the maintenance terminal device. It is characterized by

  According to this configuration, it is possible to eliminate the need for a log collection server dedicated to log information, and to suppress an increase in the traffic volume of the network and an increase in storage capacity required for the log information.

  In the server device specifying step, the maintenance terminal device sequentially inquires the route from the upstream transfer device on the user terminal device side to the downstream transfer device on the server device side. It may be configured to identify the server device accessed by the user terminal device.

  According to this configuration, since the route is sequentially inquired from the upper transfer apparatus, the server apparatus accessed by the user terminal apparatus can be suitably identified.

  According to the present invention, it is possible to suppress an increase in the traffic volume of the network and an increase in the storage capacity required for log information.

It is a schematic diagram which shows the log information management system which concerns on embodiment of this invention. It is a block diagram showing a log information management system concerning an embodiment of the present invention. It is a figure which shows the example of a route database. It is a figure for demonstrating the hashing by a BloomFilter system. It is a sequence diagram explaining the operation example of the log information management system which concerns on embodiment of this invention, Comprising: It is a figure for demonstrating a packet processing method. It is a sequence diagram explaining the operation example of the log information management system which concerns on embodiment of this invention, Comprising: It is a figure for demonstrating the search method of log information.

Reservation Reassignment System
Subsequently, embodiments of the present invention will be described with reference to the drawings. As shown in FIG. 1, a log information search system 1 according to an embodiment of the present invention is applied to a system in which a user terminal device 10 accesses any one of a plurality of server devices 20 and receives a Web service.

  The log information search system 1 is a system for searching for log information related to the user terminal device 10. Here, the log information is information generated from an OS (Operation System), middleware, an application or the like in the server device 20 when the user terminal device 10 accesses the server device 20. The log information includes, for example, information such as authentication, operation, syslog, access, error and the like. The log information search system 1 includes a plurality of server devices 20, a plurality of transfer devices 30, and a maintenance terminal device 40. The user terminal device 10 is communicably connected to the plurality of server devices 20 via the network NW configured by the plurality of transfer devices 30. Further, the maintenance terminal device 40 is communicably connected to the plurality of transfer devices 30 and the plurality of server devices 20.

<User terminal device>
The user terminal device 10 is a so-called web client that receives a service from the server device 20 using HTTP (HyperText Transport Protocol). As shown in FIG. 2, the user terminal device 10 includes an operation unit 11, a notification unit 12, and a control unit 13.

  The operation unit 11 includes a keyboard, a mouse, and the like, and outputs an operation result based on an operation by the user to the control unit 13. The notification unit 12 is configured of a monitor for image output, a speaker for audio output, and the like.

  The control unit 13 includes a central processing unit (CPU), a read only memory (ROM), a random access memory (RAM), an input / output circuit, and the like. The control unit 13 controls the operation unit 11 and the notification unit 12, and transmits / receives data to / from another device by the transmission / reception function unit 13a. In the present embodiment, the transmission / reception function unit 13a is configured by, for example, a NIC (Network Interface Controller) or the like, and performs packet communication with another device.

<Server device>
As shown in FIG. 1, the server device 20 is a so-called web server that provides a service to the user terminal device 10 using HTTP. The server device 20 is configured by a CPU, a ROM, a RAM, a hard disk, an input / output circuit, and the like. As illustrated in FIG. 2, the server device 20 includes a storage unit 21, a log management unit 22, and a transmission / reception function unit 23 as functional units.

  The storage unit 21 is configured by, for example, a hard disk or the like, and includes a log information database (DB) 21 a. The log information DB 21a stores key information (for example, an IP address) unique to the user terminal device 10 and log information of the user terminal device 10 for the server device 20 in association with each other.

  The log management unit 22 manages (stores, updates, corrects, deletes, etc.) the log information DB 21 a of the storage unit 21. The log management unit 22 is embodied by a CPU (not shown) executing a log management program.

  The transmission / reception function unit 23 is configured of, for example, an NIC, and transmits / receives data to / from another device.

<Transfer device>
As shown in FIG. 1, the transfer device 30 is disposed in the network NW, and configures a route by which packets are transmitted between the user terminal device 10 and the server device 20. Examples of the transfer device 30 include switches and routers provided in the network NW. In the present embodiment, a network NW formed by a plurality of transfer devices 30 is provided in the data center, and has a tree structure in which it branches from the upstream side of the user terminal device 10 to the downstream side of the server device 20. Configure.

  Moreover, in the example shown in FIG. 1, the tree structure which the network NW by the transfer apparatus 30 comprises exhibits three-layer structure. The transfer device 30 of the first layer (uppermost stream) is communicably connected to one or more (preferably, two or more) transfer devices 30 of the second layer. The second layer transfer device 30 is communicably connected to one or more (preferably, two or more) transfer devices 30 of the third layer (the most downstream). The third layer (most downstream) transfer device 30 is communicably connected to one or more (preferably, two or more) server devices 20.

  For simplification of the description, in the example shown in FIGS. 2, 4 and 5, the tree structure formed by the network NW by the transfer device 30 exhibits a two-layer structure by the upper transfer device 30A and the lower transfer device 30B. .

  As shown in FIG. 2, the transfer device 30 includes, as functional units, a storage unit 31, a route management unit 32, a route determination unit 33, and a transmission / reception function unit 34. The route management unit 32 and the route determination unit 33 are embodied as a CPU (not shown) executes a route management determination program.

  The storage unit 31 includes a route database (DB) 31a. In the route DB 31a, key information (for example, an IP address) unique to the user terminal device 10 that has accessed the server device 20 and route information of the user terminal device 10 are stored in association with each other. Here, the route information includes the IP address and the like of the next device (transfer device 30 or server device 20) of the transfer device 30 which is the own device in the route to the server device 20 to which the user terminal device 10 accesses. Further, the storage unit 31 also stores information on the entire structure of the network NW.

  The route management unit 32 manages (stores, updates, corrects, deletes, etc.) the route DB 31 a of the storage unit 31. When a packet passes through the transfer device 30, which is the own device, the route management unit 32 stores the correspondence in the route DB 31a based on the packet. Further, the route management unit 32 hashes the information for the route DB 31a, that is, the key information, and stores the information in the route DB 31a (see FIG. 3). This is to realize size reduction and high-speed search of the route DB 31a. In the present embodiment, the route management unit 32 hashes the key information of the user terminal device 10 that has accessed the route for each of the route information, using, for example, the Bloom Filter format. That is, in FIG. 3, the number in the column of “route” is a number indicating route information (for example, a connection number unique to the lower apparatus with respect to the transfer device 30). The data in the column of “hashed key information” indicates the user terminal device 10 that has accessed the server device 20 using the route.

  As shown in FIG. 4, when hashing is performed using the BloomFilter format, k hash functions are applied to the search machine keys x1, x2, x3,... (For example, the IP address of the user terminal 10). It is defined. The route management unit 32 assigns the hash value of each search key to the m-bit array, and sets the corresponding bit to 1 and the other bits to 0. The route management unit 32 performs calculation with the k hash functions for the search key y to be searched, and selects the corresponding bit based on the hash value that is the calculation result. If 0 is included in the selected bits, the route management unit 32 determines that there is no correspondence. If all of the selected bits are 1, the route management unit 32 determines that there is a possibility (including false positives).

  The route determination unit 33 refers to the storage unit 31 using the IP address or the like of the server device 20 included in the packet transmitted by the higher-level device (the user terminal device 10 or the transfer device 30A), thereby forwarding the packet. That is, the route to the lower device (transfer device 30B or server device 20) is determined.

  The transmission / reception function unit 34 is configured of, for example, a NIC (Network Interface Controller) or the like, and transmits / receives data to / from another device.

<Maintenance terminal device>
As illustrated in FIG. 1, the maintenance terminal device 40 identifies the server device 20 accessed by the user terminal device 10 using the correspondence relationship stored in the route DB 31 a of the transfer device 30, and the identified server device 20 The log information related to the user terminal device 10 stored in the log information DB 21a of is collected. Also, the maintenance terminal device 40 is accessed by the user terminal device 10 by sequentially inquiring a route from the upstream transfer device 30 on the user terminal device 10 side to the downstream transfer device 30 on the server device 20 side. The server device 20 is identified.

  As shown in FIG. 2, the maintenance terminal device 40 includes an operation unit 41, a notification unit 42, and a control unit 43.

  The operation unit 41 includes a keyboard, a mouse, and the like, and outputs an operation result based on an operation by the user to the control unit 13. The notification unit 42 is configured of a monitor for image output, a speaker for audio output, and the like.

  The control unit 43 is configured of a CPU, a ROM, a RAM, an input / output circuit, and the like. The control unit 43 controls the operation unit 41 and the notification unit 42, and transmits / receives data to / from another device by the transmission / reception function unit 43a.

  The control unit 43 also includes a log collection unit 43b and a log analysis unit 43c as functional units. The log collection unit 43 b and the log analysis unit 43 c are embodied by a CPU (not shown) executing a log collection and analysis program.

  The log collecting unit 43b generates a route search request signal including key information (for example, an IP address) of the user terminal device 10 that is the collection target of the log information based on the operation of the operation unit 41 by the operator. Also, the log collection unit 43b outputs the generated route search request signal to the transmission / reception function unit 43a. Also, the log collection unit 43 b identifies the server device 20 accessed by the user terminal device 10 based on the search result (route information) collected from the transfer device 30. Also, the log collection unit 43b collects log information on the user terminal device 10 from the identified server device 20, and outputs the collected log information to the log analysis unit 43c.

  The log analysis unit 43c acquires the log information output from the log collection unit 43b, analyzes the acquired log information, and outputs the analysis result to the notification unit 42.

<Operation example>
Subsequently, an operation example of the log information search system 1 according to the embodiment of the present invention will be described.

<Packet processing sequence>
First, a packet processing sequence by the transfer device 30 and the server device 20 will be described with reference to FIG.

  When the user operates the operation unit 11 (see FIG. 2) of the user terminal device 10, the control unit 13 generates a Web page request signal based on the operation result of the operation unit 11 and outputs it to the transmission / reception function unit 13a ( Step S1).

  Subsequently, the transmission / reception function unit 13a acquires a Web page request signal, and packetizes and transmits the acquired Web page request signal (Step S2). The packetized Web page request signal includes the IP address of the user terminal device 10 and the IP address of the server device 20 of the access destination.

  Subsequently, the transmission / reception function unit 34 of the upper transfer device 30A receives the packet, generates a route determination request signal based on the received packet, and outputs the generated route determination request signal to the route determination unit 33. (Step S3A). The route determination request signal includes the IP address of the access destination server device 20 included in the packet.

  Subsequently, the route determination unit 33 acquires a route determination request signal, generates route information based on the acquired route determination request signal and the information in the storage unit 31, and transmits the generated route information to the transmission / reception function unit 34. Output (step S4A).

  Subsequently, the transmission / reception function unit 34 acquires route information, and outputs the acquired route information and packet information to the route management unit 32 (step S5A). Subsequently, the route management unit 32 acquires route information and packet information, and stores the acquired route information and packet information in the route DB 31a (updating of the route DB 31a, step S6A). Subsequently, the route management unit 32 outputs the storage result (update result) of the route DB 31a to the transmission / reception function unit 34 (step S7A).

  Subsequently, the transmitting / receiving function unit 34 transfers the packet to the lower transfer device 30B based on the route information (step S8A). The order of steps S5A to 7A and step S8A can be interchanged and may be simultaneous (the same applies to steps S5B to S7B and step S8B described later).

  Subsequently, each functional unit of the lower transfer device 30B executes the same operation as the above-described steps S3A to S8A (steps S3B to S8B). Here, in step S8B, the transmission / reception function unit 34 of the lower transfer device 30B transfers the packet to the server device 20 based on the route information.

  The route management unit 32 executes steps S6A and S6B on all the packets. As described above, when the route management unit 32 performs hashing using the BloomFilter format, the route management unit 32 may combine a combination of one route information and a plurality of key information as one data. it can. Therefore, in steps S6A and S6B, the route management unit 32 updates one integrated data.

  In addition, when the route management unit 32 performs general hashing other than the BloomFilter format, the route management unit 32 additionally registers key information corresponding to the packet for each packet passage with respect to one route information. Do. Here, when the key information of the same user terminal device 10 overlaps one route information, the route management unit 32 may have a function of deleting duplicate data.

  Subsequently, the transmission / reception function unit 23 of the server device 20 receives the packet, generates a log generation request signal based on the received packet, and outputs the generated log generation request signal to the log management unit 22 (step S9). ). Subsequently, the log management unit 22 generates log information based on the log generation request signal and stores the log information in the log information DB 21a (step S10).

  Subsequently, the server device 20 generates an HTTP response signal based on the packet, and the transmission / reception function unit 23 transmits the generated HTTP response signal to the lower transfer device 30B (step S11). Subsequently, the transmission / reception function unit 34 of the lower transfer device 30B receives the HTTP response signal, and transmits the received HTTP response signal to the upper transfer device 30A (step S12B). Subsequently, the transmission / reception function unit 34 of the upper transfer device 30A receives the HTTP response signal, and transmits the received HTTP response signal to the user terminal device 10 (step S12A). Subsequently, the transmission / reception function unit 13a of the user terminal device 10 receives the HTTP response signal, and outputs the received HTTP response signal to the control unit 13 (step S13).

  Subsequently, the control unit 13 acquires an HTTP response signal, and causes the notification unit 42 (see FIG. 2) to display a Web page based on the acquired HTTP response signal.

<Search sequence>
Next, a search sequence by the maintenance terminal device 40 will be described with reference to FIG. Here, in steps S21A to S26A and S21B to S21B, “the maintenance terminal device 40 specifies the server device 20 accessed by the user terminal device 10 using the correspondence stored in the transfer device 30. "Step" is an example. Steps S27 to S33 are an example of “a log information collecting step in which the maintenance terminal device 40 collects log information regarding the user terminal device 10 stored in the identified server device 20”.

  When the operator operates the operation unit 41 (see FIG. 2) of the maintenance terminal device 40, the log collection unit 43b generates a route search request signal based on the operation result of the operation unit 41 and outputs it to the transmission / reception function unit 43a. (Step S21A). The route search request signal includes the IP address of the user terminal device 10. Subsequently, the transmission / reception function unit 43a acquires a route search request signal, and transmits the acquired route search request signal to the upper transfer device 30A (step S22A).

  Subsequently, the transmission / reception function unit 34 of the upper transfer device 30A receives the route search request signal, and outputs the received route search request signal to the route management unit 32 (step S23A). Subsequently, the route management unit 32 refers to the route DB 31a using the route search request signal, reads the corresponding route information, and outputs the read route information as the route search result to the transmission / reception function unit 34 (step S24A) ). Subsequently, the transmitting / receiving function unit 34 acquires a route search result, and transmits the acquired route search result to the maintenance terminal device 40 (step S25A). Subsequently, the transmission / reception function unit 43a of the maintenance terminal device 40 receives the route search result, and outputs the received route search result to the log collection unit 43b (step S26A).

  When the log collection unit 43b acquires the route search result, the maintenance terminal device 40 and the lower transfer device 30B execute the same operation as the above-described steps S21A to S26A (steps S21B to S26B). Here, in step S26B, the log collection unit 43b acquires a search result including route information for specifying the server device 20.

  Subsequently, the log collection unit 43b generates a log request signal based on the acquired search result, and outputs the generated log request signal to the transmission / reception function unit 43a (step S27). Subsequently, the transmission / reception function unit 43a acquires a log request signal, and transmits the acquired log request signal to the server device 20 (step S28).

  Subsequently, the transmission / reception function unit 23 of the server device 20 receives the log request signal, and outputs the received log request signal to the log management unit 22 (step S29). Subsequently, the log management unit 22 acquires a log request signal, refers to the log information DB 21a using the acquired log request signal, and reads corresponding log information (step S30). Subsequently, the log management unit 22 outputs the read log information to the transmission / reception function unit 23 (step S31).

  Subsequently, the transmission / reception function unit 23 acquires log information, and transmits the acquired log information to the maintenance terminal device 40 (step S32). Subsequently, the transmission / reception function unit 43a of the maintenance terminal device 40 receives the log information, and outputs the received log information to the log collection unit 43b (step S33). Subsequently, the log collection unit 43b acquires log information, and outputs the acquired log information to the log analysis unit 43c (step S34). Subsequently, the log analysis unit 43c acquires log information, analyzes the acquired log information, and outputs an analysis result to the notification unit 42 (step S35).

  The log information search system 1 according to the embodiment of the present invention enables each transfer device 30 to search for log information stored in each server device 20 by storing route information. Therefore, the log information search system 1 can eliminate the need for a log collection server dedicated to log information, and can suppress an increase in traffic volume of the network NW and an increase in storage capacity required for log information.

  Moreover, since the log information search system 1 inquires the route sequentially from the upper transfer device 30, the server device 20 accessed by the user terminal device 10 can be suitably identified.

  Further, since the log information search system 1 stores the information of the user terminal device 10 accessed at the time of packet passage in the route DB 31a, all routes of the user terminal device 10 are searched by referring to the route DB 31a at the time of route search. It can be searched.

  Further, since the key information included in the route DB 31a is hashed, the log information search system 1 can realize size reduction and high-speed search of the key information.

  As mentioned above, although embodiment of this invention was described, this invention is not limited to the said embodiment, It can change suitably in the range which does not deviate from the summary of this invention. For example, the communication method between the user terminal device 10 and the server device 20 may be a method other than packet communication. The present invention can also be embodied as the above-described log management program, route management determination program, and log collection and analysis program.

1 Log Information Search System 10 User Terminal Device 20 Server Device 30 Transfer Device 40 Maintenance Terminal Device

Claims (6)

A log information search system for searching for log information related to a user terminal device in a network communicably connecting a user terminal device and a plurality of server devices, comprising:
A plurality of transfer devices provided in the network and configuring a route between the user terminal device and the server device;
A maintenance terminal,
Equipped with
The server device stores log information on the user terminal device,
The transfer device stores correspondence relationships between key information of the user terminal device and route information on a route between the user terminal device and the server device.
The maintenance terminal device identifies the server device accessed by the user terminal device using the correspondence stored in the transfer device, and relates to the user terminal device stored in the identified server device A log information search system characterized by collecting log information. The maintenance terminal apparatus is accessed by the user terminal apparatus by sequentially inquiring the route from the upstream transfer apparatus on the user terminal apparatus side to the downstream transfer apparatus on the server apparatus side. The log information search system according to claim 1, wherein the server apparatus is identified. The log information search system according to claim 1 or 2, wherein when the packet passes through the transfer device, the transfer device stores the correspondence based on the packet. The log information search system according to any one of claims 1 to 3, wherein the transfer device has hashed the key information included in the correspondence relationship. A method for searching log information in a log information search system for searching log information related to a user terminal device in a network communicably connecting a user terminal device and a plurality of server devices, comprising:
The log information search system is provided in the network, and includes a plurality of transfer devices constituting a route between the user terminal device and the server device, and a maintenance terminal device.
The server device stores log information on the user terminal device,
The transfer device stores correspondence relationships between key information of the user terminal device and route information on a route between the user terminal device and the server device.
A server device specifying step of specifying the server device accessed by the user terminal device using the correspondence relationship stored in the transfer device by the maintenance terminal device;
A log information collecting step of collecting log information on the user terminal device stored in the specified server device by the maintenance terminal device;
A log information search method comprising: In the server device specifying step, the maintenance terminal device sequentially inquires the route from the upstream transfer device on the user terminal device side to the downstream transfer device on the server device side. The log information search method according to claim 5, wherein the server device accessed by a user terminal device is identified.

Images