JPH10327217A - Log management system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To manage logs in a generation order without executing a complicated sort processing and to improve processing ability by sequentially storing the logs exceeding maximum delay time. SOLUTION: A decision means 3 decides whether informed monitoring information is to be stored in an output buffer after several unit time passes from a difference between generation time given to informed device information and the present time of a monitor device and from maximum delay time. A first storage means 4 stores informed device information in the buffer decided by decided delay time and the content of a buffer management table 2 as the log. A log storage area 5 stores the recorded and displayed logs. A rotation means 6 rotates the role of the buffer, which is registered in the buffer management table 2 at every unit time. A second storage means 7 takes out all the contents of the output buffer after zero time passes among the rotated buffers at every unit time and outputs them to the log storage area 5.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a log management system in which a monitoring device records and displays, as a log, device information such as a status change and a failure sent from a monitored device. Various forms are conceivable for a monitoring system in which a monitoring device monitors a change in state or a failure of a monitored device, and a communication network can be mentioned as a simple example. FIG. 19 shows a configuration example of a communication network. As is well known, in a communication network, line switching information in a transmission device (communication device), change of a clock follow-up destination for avoiding a failure, switching of a redundant system, data saving when operation data is changed online, and establishment of a line. Information is monitored at a center or the like. Therefore, in the communication network, FIG.
In step 9, the monitoring device 50 causes the transmission device (monitored device) 60 under the monitoring device 50 to transmit the status change information and the failure information together with the time of occurrence, and records and displays the information as a log for each monitored device. Will be When there is a higher-level monitoring device 70 that comprehensively monitors a plurality of such communication networks and sub-networks, the monitoring device 50 of each network notifies the higher-level monitoring device 70 of the collected log information. . Thus, in the monitoring system,
Generally, when a monitored device detects occurrence of device information such as a change in the state of a device or a failure, the device information is notified to the monitoring device by giving the time of occurrence, and the monitoring device logs the device information as a log. A log management system for recording and displaying is adopted. Hereinafter, a log management method adopted in the conventional monitoring system will be specifically described with reference to FIGS.

[0002]

2. Description of the Related Art FIG. 20 shows a configuration example of a conventional monitoring apparatus. FIG. 21 is a processing flowchart of a conventional buffer storage unit. FIG. 22 is a processing flowchart of a conventional log management unit. FIG. 23 is an explanatory diagram of a conventional log sorting result. In FIG. 20, the monitoring device is a buffer 5
1, a log management unit 52, a buffer storage unit 53, a log storage area 55, an internal clock 54, a GUI (graphic user interface) 56, notification units 57 and 58, and the like.

[0003] Device information such as a status change with a time of occurrence or a failure generated by a transmission device (hereinafter referred to simply as "status change")
) Is input to the buffer storage unit 53 via the notification unit 58. The buffer storage unit 53 stores the notified state change as a log in the buffer 51 together with the occurrence time. The log management unit 52 reads the log from the buffer 51 while referring to the internal clock 54, and notifies the higher-level monitoring device via the notifying unit 57 when a higher-level monitoring device exists, Is stored in the log storage area 55. The logs collected and stored in the log storage area 55 in this manner are read by the GUI 56 and displayed on a display unit (not shown) of the GUI 56.

Here, the status change notified from the monitored device is not always in the order of the occurrence time due to the transmission delay or the difference in the method of detecting the status change in the monitored device. In the monitoring apparatus, it is necessary to perform a sorting process for arranging the notified status change logs in order of occurrence time. This sorting process is performed by the buffer storage unit 53 and the log management unit 52.

That is, the buffer storage unit 53 sorts the notified log of the status change according to the procedure shown in FIG. 21 and temporarily stores it in the buffer 51, and the log management unit 52 executes the maximum delay time according to the procedure shown in FIG. Buffer 5 in ascending order
By reading from the first and storing it in the log storage area 55,
Logs can be managed in chronological order. In addition,
The maximum delay time is the maximum value of the elapsed time (delay time) from when the monitored device detects a state change to when the monitoring device receives the notification of the state change, and the value is determined for each monitored device. Is known.

A conventional log sorting method will be described below with reference to FIGS. 21, the buffer storage unit 53 manages the number of logs stored in the buffer 51, and stores logs in the buffer 51 as follows based on the number of logs in the buffer. Upon receiving a notification of the state change with the occurrence time from the monitored device (S50), the address pointer is first set to the address (recNo = 0) for storing the first log (S51), and the address (recN) is set.
Since (o = 0) is not the address for storing the last log (S52), the address for storing the first log (recNo)
= 0) and the notified state change occurrence time are determined (S53), and the occurrence time read from the address (recNo = 0) is set to be greater than the notified state change occurrence time. If it is larger, the address pointer is advanced by recNo = recNo + 1 (S54), and it is determined again whether the address (recNo) is the address for storing the last log (S52).

That is, the address for storing the last log is detected by the repetitive processing of S52 → S53 → S54 → S52, but in the middle, recNo storing the occurrence time smaller than the notified occurrence time of the state change. Is detected (S53), the status change notified this time is stored in the next address (recNo) (S55), the number of managed logs is incremented by 1 (S57), and the notification of the next status change is awaited.
(S50).

On the other hand, if the recNo storing the occurrence time smaller than the occurrence time of the state change notified by the repetition processing of S52 → S53 → S54 → S52 is not detected (S53), the address where the last log is stored is changed. When detected (S52), the status change notified this time is stored in the next address (recNo) (S55), the number of logs to be managed is incremented by 1 (S56), and the notification of the next status change is awaited (S56). S50). As described above, the logs are stored in the buffer 51 in the order of occurrence time.

Next, in FIG. 22, a log management unit 52
Acquires the current time with reference to the internal clock 54 (S6).
0), and reads the first log from the buffer 51 (S6).
1) If the time obtained by adding the maximum delay time to the log generation time is larger than the current time, the first log of the buffer 51 is stored in the log storage area 55 (S63), and the process returns to S60 and returns to the next log. Execute the processing of

On the other hand, in S62, if the time obtained by adding the maximum delay time to the log occurrence time is smaller than the current time, the head log is not stored in the log storage area 55, and the process returns to S60. Performs processing for logs.
The above processing is performed for all the addresses (recNo) in the buffer 51, so that the logs that have passed the maximum delay time are sequentially stored in the log storage area 55.

[0011]

However, in the above-described conventional sorting processing, the load on the monitoring device increases as the number of logs increases. Particularly, in a higher-level monitoring device that performs integrated monitoring of a plurality of networks and sub-networks, the number of monitored devices increases, so that the load of the sorting process further increases.

As the time used in the log management of the monitoring device, a method of using an occurrence time given by the monitored device, a method of using the time of the monitoring device corresponding to the occurrence time of the monitored device, and the like are adopted. However, if the time is changed in any case, if the time overlaps before and after the time change, sorting cannot be performed correctly, that is, the order of occurrence in the monitored device will not be the same. Therefore, the time relationship between the logs before and after the time is changed cannot be understood. Hereinafter, description will be made with reference to FIG.

FIG. 23A shows the contents of the buffer 51 (log storage state). In this state, when the monitoring device and the monitored device change the time, when the status change notification with the occurrence time of 10:00:02 is received, the result of sorting the log as the log f is shown in FIG. Become like FIG. 23 (b)
As a result, the logs are arranged in the order of the time of the logs as a result of the sorting, but this does not indicate the order of occurrence in the monitored device. Therefore, the trouble investigation will be hindered.

Further, in the internal clock of the monitoring device, there is a limit on a range representing time, and if the limit is exceeded, correct time display is impossible. Therefore, conventionally, the life of the inspection device depends on the internal clock and the OS, and improvement is desired. An object of the present invention is to be able to store logs in the order of occurrence in the monitored device without performing a sort process, to recognize a state change at a correct time interval in logs before and after the time is changed even when the time is changed, and to be able to represent an internal clock It is an object of the present invention to provide a log management method that enables a correct time to be displayed even when the time exceeds a proper time range.

[0015]

FIG. 1 is a block diagram showing the principle of the first to seventh aspects of the present invention. Claim 1
In the invention described in (1), 1 is added to the number obtained by dividing the maximum value of the delay time from the occurrence of the device information with the occurrence time notified to the monitoring device from the monitored device to the monitoring device by the unit time by the unit time. Buffer 1 (A, B, C, D ...)
And a buffer management table 2 for managing how many units of time, including the time after the lapse of 0 hours, each of the plurality of buffers 1 is to store a log to be output, and the occurrences assigned to the notified device information. Determining means 3 for determining, from the difference between the time and the current time of the monitoring device and the maximum delay time, a delay time for determining how many unit times the notified monitoring information should be stored in the output buffer; First storage means 4 for storing the device information as a log in a buffer determined by the delay time determined by the determination means 3 and the contents of the buffer management table 2, and a log storage area 5 for storing logs to be recorded and displayed. Rotation means 6 for rotating the role of the buffer registered in the buffer management table 2 per unit time, and the rotation means 6 0 out of over implementation to buffer
A second storage means for extracting all the contents of the output buffer after a lapse of time and outputting the contents to the log storage area.

That is, according to the first aspect of the present invention, the buffer 1 is prepared for the number obtained by adding +1 to the number obtained by dividing the maximum delay time by the unit time, and the buffer management table 2 manages the role of each buffer. Specifically, assuming that the maximum delay time is T in the buffer 1, the buffer 1 outputs for 0 seconds, outputs for 1 second, outputs for 2 seconds,..., Outputs for T seconds. Is given.

Based on the difference between the occurrence time given to the notified device information and the current time of the monitoring device and the maximum delay time, the determining means 3 outputs the notified monitoring information after a lapse of several unit times. When the delay time to be stored in the buffer is determined, the first storage unit 4 determines the notified device information by the buffer determined by the delay time determined by the determination unit 3 and the contents of the buffer management table 2 (the illustrated example). Then, the log is stored in the buffer B).

On the other hand, the rotation means 6 rotates the role of the buffer registered in the buffer management table 2 every unit time. Specifically, output after 1 second is output for 0 seconds, output after 2 seconds is output for 1 second, output after 0 seconds is output for T seconds In addition, each is rotated every unit time. That is, each buffer is used for output after elapse of 0 seconds in the cycle of the maximum delay time.

Then, the second storage means 7 fetches all the contents of the output buffer after the elapse of 0 seconds among the buffers rotated by the rotation means 6 for each unit time and outputs them to the log storage area. As a result, logs are stored in the log storage area 5 in the order of occurrence time without the need for complicated sorting processing as in the related art.

According to a second aspect of the present invention, in the log management system according to the first aspect, priority management in which a delay time is fixedly set according to the content of the device information regardless of the generation time of the device information. When the notified device information is defined in the priority management table 8, the determination unit 3 stores the delay time of the corresponding device information in the priority management table 8 after a lapse of a certain unit time. It is characterized in that it is adopted as a delay time to be performed.

In other words, according to the second aspect of the present invention, when the notified device information is defined in the priority management table 8, the determining means 3 determines the delay time set in the priority management table 8. Is adopted, it is possible to preferentially handle device information having a high degree of urgency. A third aspect of the present invention is the log management system according to the first or second aspect, further comprising a notifying unit 9 for notifying a higher-level monitoring device of a log at a timing when the log is stored in the log storage area 5. I do.

That is, according to the third aspect of the present invention, the log notified by the notifying means 9 to the higher-level monitoring device is stored in the second storage means 7.
Is the timing at which the data is stored in the log storage area 5, so that the upper-level monitoring device does not need to perform any special sort processing, and the load can be reduced. The invention described in claim 4 is the first invention.
Alternatively, in the log management system according to claim 2, the error time between the standard time and the internal clock 10a is managed, and
It is characterized by comprising a time management means 10 for giving the time obtained by adding the error time to 0a to the determination means 3 and the second storage means 7 as the current time of the monitoring device.

That is, in the invention according to claim 4, the time management means 10 gives the time obtained by adding the error time to the internal clock 10a to the determination means 3 and the second storage means 7 as the current time of the monitoring device. The determination unit 3 and the second storage unit 7 can calculate the correct delay time even if the time cannot be represented by the internal clock 10a, and can store the time in the log storage area 5 with the correct timing.

According to a fifth aspect of the present invention, in the log management system according to the fourth aspect, the time management means 10 monitors the time obtained by changing the error time in response to the change of the standard time. Is set as the current time. In other words, according to the fifth aspect of the invention, when the time is changed, the error time is manipulated to obtain the current time of the monitoring device, so that the time change process is simplified.

According to a sixth aspect of the present invention, in the log management system according to the fourth or fifth aspect, at least the second storage means 7 adds an error time to the log and stores the log in the log storage area 5. It is characterized by the following. That is, in the invention according to claim 6, as the log stored in the log storage area 5,
An error time at the time of occurrence can be included in addition to the time of occurrence. However, the first storage unit 4 may store the error time in the buffer 1 in advance. That is, it is sufficient that the error time is included when the data is finally stored in the log storage area 5 and notified to the host monitoring device.

According to a seventh aspect of the present invention, in the log management system according to the fourth or fifth aspect, the generation time at which the log to be displayed on the display unit in response to the display designation is displayed is stored in the log storage area 5. A display log obtained by substituting the occurrence time obtained from the log and the occurrence time and the current error time obtained from the time management means 10 into the following expression: occurrence time = occurrence time−error time of occurrence time + current error time It is characterized by comprising output means 11.

That is, according to the present invention, the occurrence time (display time of the device information before the time change) acquired from the log can be displayed by the time after the time change, so that the device information after the time change and the device information after the time change can be displayed. Can be displayed correctly.

[0028]

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 2 is a block diagram of a monitoring apparatus having a log management system according to the first to seventh embodiments. The same functional components as those of the conventional example (FIG. 20) include:
The same reference numerals are given. In the monitoring device of this embodiment,
The functions of the buffer 51, the log management unit 52, the buffer storage unit 53, and the display unit of the GUI 56 shown in FIG.
3 and GUI 24, and a new buffer management table 2
5, a priority management table 26, an error time table 27, and a time management unit 28 are provided.

The buffer management table 25 is connected to both the buffer storage unit 23 and the log management unit 22. The priority management table 26 is connected to the buffer storage unit 23. The error time table 27 and the internal clock 54 are connected to the time management unit 28, and the time management unit 28 is connected to the buffer storage unit 23, the log management unit 22, and the GUI 24. In the above configuration, the correspondence with the claims is as follows. The buffer 21 corresponds to the buffer 1. The buffer management table 2 includes a buffer management table 25.
Corresponds. The buffer storage unit 23 corresponds to the determination unit 3 and the first storage unit 4. A log storage area 55 corresponds to the log storage area 5. The log management unit 22 corresponds to the rotation unit 6, the second storage unit 7, and the notification unit 9. The priority management table 8 includes the priority management table 2
6 corresponds. The time management unit 28 mainly corresponds to the time management unit 10. A GUI 24 mainly corresponds to the display log output unit 11.

The operation of the log management system according to the first to seventh embodiments will be described below with reference to FIGS. 3 to 8 are explanatory diagrams of the contents and operation of each element according to this embodiment. 9 to 15 are explanatory diagrams of a specific example of the log storage process. 16 and 17
Is an explanatory diagram of log display. FIG. 18 is an explanatory diagram of a setting example when the value exceeds the range that can be expressed by the internal clock.

First, the content of each element according to this embodiment
The operation will be described. The buffer 21 is an aggregate of buffers obtained by adding 1 to the number obtained by dividing the maximum delay time by the unit time. Specifically, in this embodiment, since the cycle of storing data from the buffer 21 to the log storage area 55 is 1 second, “1 second” is used as the unit time. Therefore, if the maximum delay time is, for example, 5 seconds, the buffer 2
1 is composed of six buffers.

The buffer management table 25 stores the buffer 2
1 is a table that manages how many units of time, including the time after 0 seconds have elapsed, before storing the data into the log storage area 55 or the buffer storing the log to be notified to the higher-level monitoring device. is there. In the following description, it is simply referred to as "output", including both of storing in the log storage area 55 and notifying the host monitoring device.

FIG. 3 shows an example of the configuration of the buffer management table 25. In FIG. 3, since T is the maximum delay time, the buffer management table 25 has (T + 1) pointers. The pointers include “pointer to output buffer after 0 seconds”, “pointer to output buffer after 1 second”, and “pointer to output buffer after 2 seconds”.
The role is defined as "pointer to output buffer after 3 seconds", "pointer to output buffer after 4 seconds" ... "pointer to output buffer after T seconds".

The priority management table 26 is a table in which the delay time is fixedly set according to the content of the status change, regardless of the occurrence time attached to the status change notified from the monitored device. FIG. 4 is a configuration example of the priority management table. As shown in FIG. 4, the priority management table 26
, “State change” and “delay time” are set in association with each other.

The error time table 27 stores the error time obtained by the procedure shown in FIG. FIG. 5 is a processing flowchart of the time management unit 28. In this embodiment, it is assumed that the time of the monitoring device always coincides with the time of the monitored device, and the monitoring device constantly resets the time of the monitored device. This resetting is performed by the operator inputting from a display unit (not shown) of the GUI 24, and the “time change request” input by the operator is input to the time management unit 28 via the GUI 24.

In FIG. 5, when a time change request from the operator is input (S1), the time management unit 28 changes the time of the monitored device to the requested time (standard time) (S2) and sets the internal clock. The time of 54 is acquired (S3),
An error time which is a difference between the request time and the time of the internal clock 54 is obtained (S4), and the contents of the error time table 27 are updated (S5). As described above, every time the time of the monitored device is changed, the error time is obtained, and the contents of the error time table 27 are updated.

Therefore, the time of the monitoring device is basically the time of the internal clock 54, but considering the time change, the “error time” obtained as described above is calculated based on the “error time”.
This is the time added to the time of 4. This means
When the time of the monitored device is changed and the time of the monitoring device is changed accordingly, without changing the time of the internal clock 54,
This indicates that the "error time" should be changed.

Basically, the buffer storage unit 23 receives the state change notification input from the communication unit 58, and generates the time of occurrence and the time of the internal clock 54 added to the input state change notification. The delay time is obtained by applying the current time of the monitoring device) and the maximum delay time to the following equation (1). Delay time = maximum delay time− (current time of monitoring device−occurrence time) (1) Then, the buffer storage unit 23 refers to the buffer management table 25 based on the delay time, and A “second output buffer” is determined, and the state change notification received and input is stored as a log in the determined “second output buffer” together with the occurrence time.

Actually, the log is stored in the buffer 21 according to the procedure shown in FIG. 6 in consideration of the priority management table 26 and the above-mentioned error time. FIG. 6 is a processing flowchart of the buffer storage unit 23. In FIG. 6, upon receipt of the status change notification input from the communication unit 58 (S10), the current time is obtained by adding the error time obtained from the error time table 27 to the time of the internal clock 54 (S11), and priority management is performed. With reference to the table 26, it is checked whether the notified state change is registered (S13).

If not registered, the delay time is obtained according to the above-mentioned equation (1) (S14), and the notified state change is stored as a log in the buffer indicated by the buffer management table 25 (S15). On the other hand, if it is registered in the priority management table 26, a delay time corresponding to the notified state change is obtained (S16), and the notified state change is similarly logged in the buffer indicated by the buffer management table 25. (S15).

At this time, the format of the log to be stored may be basically a set of the occurrence time and the state change, but FIG. 6 also considers the error time. Therefore, FIG.
Is an example of a log format. As shown in FIG. 7, the log format is a format that also includes an error time.

The log management unit 22 reads the contents of the buffer indicated by the “pointer to the output buffer after 0 seconds” in the buffer management table 25 shown in FIG.
5, and is notified to the higher-level monitoring device via the communication unit 57. As described above, in this embodiment, the cycle of storing from the buffer 21 to the log storage area 55 is 1 second.

FIG. 8 is a processing flowchart of the log management unit 22. The log management unit 22 stores data in the log storage area 55 according to the procedure shown in FIG. That is, in FIG. 8, the log management unit 22 performs a rotation to shift the role of the buffer registered in the buffer management table 25 by one second (S20). Specifically, in this rotation, the output buffer after 1 second is output for 0 seconds, the output buffer after 2 seconds is output for 1 second,
This is a process of setting the output buffer after 0 seconds to output after T seconds.

The log management unit 22 performs such rotation at intervals of one second. When the rotation of one second is completed, the log management unit 22 reads “all logs in the output buffer after 0 seconds, that is, The time, the error time, and the state change information are stored in the log storage area 55. If there is a higher-level monitoring device, the upper-level monitoring device is also notified via the communication unit 57 (S21), and waits (waits) until the next rotation time (S22), and performs the next rotation. (S20).

As described above, the log management unit 22 repeatedly reads and stores / notifies the contents of the “output buffer after 0 seconds” with a one-second wait between rotations at one-second intervals. I have. The log in the format shown in FIG. 7 may be formed when the log management unit 22 stores the log in the log storage area 55.

Next, a specific description will be given of the log storage processing in the log management system of this embodiment, which is performed mainly on each element described above with reference to FIGS. In the following description, at the start, the log storage area 55
Nothing is stored in the buffer 21 and the time of the internal clock 54 is 10:00:00. The error time is 1 second, the unit time is 1 second, and the maximum delay time T is 3 seconds. Therefore, the buffer 21 includes four buffers A, B, C, and D, and the buffer management table 25
Are "0 seconds after output""1"
Roles are set and managed for output for seconds, output for 2 seconds, and output for 3 seconds. In the priority management table 26, three state changes x, y, and z each having a delay time of 1 second are registered.

FIG. 9 shows a state change a at 10:00:02 at 10:00:00.
FIG. 14 is an explanatory diagram of a specific example of a log storage process when a state change b is received. In FIG. 9, 10:00:00 state change a, 1
0:00:02 It is assumed that state change b is received. Since each log is stored (notified) after a lapse of the maximum delay time (3 seconds) from the occurrence time, the buffer storage unit 23 stores the log in FIG.
In the procedure shown in, the time of the internal clock (10:00:01) + error time
(1 second) is calculated to find the current time 10:00:02, and the delay time of state changes a and b is calculated according to the maximum delay time (3 seconds) and the occurrence time. Time (3 seconds) − {Current time (10:00:02) One occurrence time (10:00:00)} = 1 second State change b delay time = Maximum delay time (3 seconds) − {Current time (10 : 00: 02) One occurrence time (10:00:02)} = 3 seconds.

In the buffer management table 25, initially, buffer A is for output after 0 seconds, buffer B is for output after 1 second,
The buffer C is managed for output after 2 seconds, and the buffer D is managed for output after 3 seconds. The buffer storage unit 23 stores a state change a,
After confirming that b is not registered in the priority management table 26, the log is stored in the buffer of the corresponding delay time by referring to the buffer management table 25. That is, the state change a having a delay time of 1 second is stored in the buffer B, and the state change b having a delay time of 3 seconds is stored in the buffer D. At this time, the current error time (1 second) is also stored as the error time of the occurrence time (see FIG. 7).

Next, FIG. 10 shows that 10:00:01 after the next one second.
It is explanatory drawing of the specific example of the log storage process when the state change c, 10:00:02 state change d is received. 9 from the state of FIG.
If 10:00:01 state change c and 10:00:02 state change d are received two seconds later, during this time, the log management unit 22 uses the procedure shown in FIG. The role of the buffer is rotated (output for 1 second, output for 0 second, output for 2 seconds for output for 1 second, ...), and buffer B is a buffer for output after 0 seconds. So
All the logs stored in the buffer B have been moved to the log storage area 55.

At this time, the time of the internal clock is 10:00:
Since it is 02, the current time is 10:00:03. As described with reference to FIG. 9, the buffer storage unit 23 calculates the delay times of the received state changes c and d. Since the delay time of the state change c is 1 second and the delay time of the state change d is 2 seconds, it is confirmed that the state changes c and d are not registered in the priority management table 26, and the buffer management table 25 is checked. And log of the state change c to the buffer C and state change d
Are respectively stored in the buffer D. The error time of the occurrence time is also one second.

Next, FIG. 11 is an explanatory diagram of a specific example of the log storage processing when the times of the monitoring device and the monitored device are changed to 10:00:00. The time management unit 28 obtains the current time of the internal clock according to the procedure shown in FIG.
The difference (−3 seconds) between (10:00:03) and the correct time (10:00:00) is obtained, and the obtained difference (−3 seconds) is stored (updated) in the error time table 27 as the error time. . Therefore, the current time when the buffer storage unit 23 calculates the delay time is 10:00:
It becomes 00.

On the other hand, since one second has elapsed, the log management unit 22 returns to the buffer management table 2 as in the previous case.
5 changes the role of the buffer managed, and moves the contents of buffer C, which is the output buffer, to the log storage area 55 after 0 seconds. In the log storage area 55, two logs of status changes a and c are stored. FIG. 12 is an explanatory diagram of a specific example of the log storage process when 10:00:01 status change e is received one second later.

Similarly, the log management unit 22 changes the role of the buffer managed by the buffer management table 25 and moves the contents of the buffer D, which is the output buffer, to the log storage area 55 after 0 seconds. Log storage area 55
Stored four logs of status changes a, c, b, and d. Since the time of the internal clock is 10:00:04, the current time is 10:00:01. The buffer storage unit 23 stores the delay time of the received state change e in the same procedure as described above.
(2 seconds), confirm that the state change e is not registered in the priority management table 26, refer to the buffer management table 25, and change the state change e to the output buffer B 2 seconds later.
Is stored together with the error time at the time of occurrence (-3 seconds).

Next, FIG. 13 is an explanatory diagram of a specific example of the log storing process after a lapse of two seconds from the state of FIG. After a lapse of 2 seconds from the state of FIG. 12, the buffer B is used for output after 0 seconds, and the log management unit 22 stores the state change e stored in the buffer B in the log storage area 5.
Moved to 5. The log storage area 55 stores five logs of status changes a, c, b, d, and e. Here, it should be noted that the order of storage in the log storage area 55 is the order of occurrence in the monitored device regardless of time change. It can be seen that a complicated sorting process as in the related art can be omitted.

FIG. 14 shows the priority management table 26.
FIG. 11 is an explanatory diagram of a specific example of a log storage process when a notification of a state change registered in the log is received. That is, FIG.
FIG. 12 is an explanatory diagram of a specific example of a log storage process when a 0:01 state change y is received. FIG. 15 shows the contents of the log storage area during this priority processing.

The roles of the four buffers A, B, C and D are as follows:
This is the same as in FIG. The current time is 10:00:02,
It is assumed that 10:00:01 state change a is stored in buffer C, and 10:00:02 state change b is stored in buffer D. In this state, when a state change y occurring at 10:00:02 is received, the buffer storage unit 23 refers to the priority management table 26, the state change y is a target of priority processing, and the delay time is 1 Know that it is seconds. Therefore, the buffer storage unit 23 refers to the buffer management table 25, obtains a buffer having a delay time of 1 second, and stores the log of the state change y in the buffer B because the buffer is the buffer B.

The log management unit 22 has a buffer for output after 0 seconds (buffer A) and a buffer for output after 1 second (buffer B).
As described above, since the logs are sequentially stored in the log storage area 55 every second, the contents of the log storage area 55 eventually become as shown in FIG. 15, and the state change y is notified first. The stored and notified higher-level monitoring devices are notified before the status changes a and b.

FIG. 16 is a flowchart of the log display. FIG. 17 is an example of a log display. This log display is performed by the GUI 24 reading a log from the log storage area 55 in response to a command from a display unit (not shown) and outputting the log to the display unit. In FIG. 16, GU
Upon receiving the display log output command from the display unit (not shown), the I24 sets a pointer to the address (recNo = 0) of the log storage area 55 where the first log is stored (S3).
0), because it is not the address where the last log is stored (S
31), the first log is read out from the address (recNo = 0), the occurrence time is extracted, the error time of the occurrence time + the current error time is extracted from the time management unit 28, and the occurrence time st of the log to be displayed is st = The occurrence time−the error time of the occurrence time + the current error time... (2) is calculated (S32).

Next, if the determined occurrence time st is the designated display target time (S33), the GUI 24
The log stored in recNo = 0 is output to the display unit, and the log is displayed (S34). The display time at this time is st obtained by Expression (2). Then, the log storage area 55
The address pointer is advanced by one to recNo = recNo + 1 (S35), and it is determined again whether or not the recNo is the address for storing the last log (S31).

On the other hand, if the occurrence time st obtained in S32 is not the designated display target time (S33), the GUI is displayed.
Reference numeral 24 denotes an address pointer of the log storage area, recNo = r
ecNo + 1 is advanced by one (S35), and it is again determined whether or not the recNo is the address for storing the last log (S35).
31). The above processing is performed for all the logs stored in the log storage area 55 (S31), and the logs to be displayed are, as shown in FIG. 17, the display of the state changes before the time change (state changes a to d). The time is displayed after being changed to the time after the time change. This shows that the time relationship with the state change after the time change is correctly displayed.

Next, FIG. 18 shows a setting example when the time that can be expressed by the internal clock has been exceeded. This is an embodiment corresponding to claim 4. In the example shown in FIG.
If the time range that can be represented by the internal clock is 1970/1/1 00:00:00 to 2030/12/31/23: 59: 59 (3), the current time is 2031/1/1 12:00:00
, The current time exceeds the range of time that can be represented by the internal clock.

In this case, the time management unit 28 returns the time of the internal clock to 1970/1/1 12:00:00, and sets the error time as the error time = (2031/1/1 / 1 12:00: 00-1970 / 1/1 12:00: 00) second Set ... (4). This makes it possible to represent the current time. Needless to say, the time at which the internal clock is returned is not limited to the example. In practice, the error time should be determined in consideration of a value that can be expressed.

[0064]

As described above, according to the first aspect of the present invention, a buffer is prepared for several minutes in which the maximum delay time is divided by a unit time, and the role of each buffer is managed. It rotates each time, finds the delay time of how long the notified monitoring information should be stored in the output buffer, stores it in the corresponding buffer, and stores it in the output buffer after the elapse of 0 seconds in the cycle of the maximum delay time. The buffer contents are stored in the log storage area. As a result, logs that have passed the maximum delay time can be sequentially stored, so that logs can be managed in the order of occurrence without the need for complicated sorting processing as in the related art, and processing performance is improved.

According to the second aspect of the present invention, when the notified device information is defined in the priority management table 8, the delay time set in the priority management table is adopted. Priority can be given depending on the content, and the reliability of the monitoring device is improved. Claim 3
According to the invention described in (1), the higher-level monitoring device can acquire the device information of the monitored devices in the order of occurrence, so that a special sorting process is not required, and the load can be reduced.

In the present invention, the time obtained by adding the error time to the internal clock is used as the current time of the monitoring device.
It is possible to represent time that can not be expressed by the internal clock,
The product life of the monitoring device is extended, and the reliability is improved. According to the inventions set forth in claims 5 to 7, since the log before the change can be referred to as the time after the change even when the time is changed, the logs before and after the time change are unifiedly managed. Can be.

[Brief description of the drawings]

FIG. 1 is a block diagram showing the principle of the invention described in claims 1 to 7;

FIG. 2 is a configuration diagram of a monitoring device having a log management system according to an embodiment corresponding to claims 1 to 7;

FIG. 3 is a configuration example of a buffer management table.

FIG. 4 is a configuration example of a priority management table.

FIG. 5 is a processing flowchart of a time management unit.

FIG. 6 is a processing flowchart of a buffer storage unit.

FIG. 7 is a diagram illustrating an example of a log format.

FIG. 8 is a processing flowchart of a log management unit.

FIG. 9 is an explanatory diagram of a specific example of a log storage process (10:00:
00 state change a, 10:00:02 state change b reception).

FIG. 10 is an explanatory diagram of a specific example of a log storage process (10: 0)
0:01 state change c, 10:00:02 state change d reception).

FIG. 11 is an explanatory diagram of a specific example of a log storage process (when the time is changed to 10:00:00).

FIG. 12 is an explanatory diagram of a specific example of a log storage process (10: 0)
0:01 State change e reception).

13 is an explanatory diagram of a specific example of a log storage process after a lapse of two seconds from the state of FIG. 12;

FIG. 14 is an explanatory diagram of a specific example of a log storage process (10: 0)
0:01 When the status change y is received).

FIG. 15 is an explanatory diagram of the contents of a log storage area.

FIG. 16 is a flowchart of a log display.

FIG. 17 is a diagram illustrating a log display example.

FIG. 18 is an explanatory diagram of a setting example in a case where a range that can be expressed by an internal clock is exceeded.

FIG. 19 is a configuration example of a communication network.

FIG. 20 is a configuration diagram of a monitoring device provided with a conventional log management method.

FIG. 21 is a processing flowchart of a conventional buffer storage unit.

FIG. 22 is a processing flowchart of a conventional log management unit.

FIG. 23 is a diagram showing a conventional log sorting result.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Buffer (A, B, C, D ...) 2 Buffer management table 3 Decision means 4 First storage means 5 Log storage area 6 Rotation means 7 First storage means 8 Priority management table 9 Notification means 10 Time management means 10a Internal clock 21 Buffer 22 Log storage area 23 Buffer storage unit 24 GUI 25 Buffer management table 26 Priority management table 27 Error time table 28 Time management unit 54 Internal clock 55 Log storage area

Claims (7)

[Claims] 1. A method in which the maximum value of the delay time from when the device information with the occurrence time is notified to the monitoring device from the monitored device to when the device information is received by the monitoring device is obtained by adding 1 to the number divided by the unit time. A buffer for several minutes, a buffer management table for managing how many units of time each of the plurality of buffers contains after 1 hour has elapsed, and a buffer management table for managing a log to be output after a lapse of unit time, attached to the notified device information From the difference between the generated time and the current time of the monitoring device and the maximum delay time, to determine the delay time as to how many unit times the notified monitoring information should be stored in the output buffer. Means for storing the notified device information as a log in the buffer determined by the delay time determined by the determining means and the contents of the buffer management table. A log storage area for storing logs to be recorded / displayed; a rotation unit for rotating the role of the buffer registered in the buffer management table for each unit time; a buffer rotated by the rotation unit for each unit time A second storage unit for extracting all the contents of the output buffer after 0 hours have elapsed and outputting the contents to the log storage area. 2. The log management method according to claim 1, further comprising: a priority management table in which a delay time is fixedly set according to the content of the device information regardless of the time of occurrence of the device information. Means, when the notified device information is defined in the priority management table, the delay time of the corresponding device information in the priority management table as a delay time of how many unit times after the time should be stored A log management method characterized by adoption. 3. The log management system according to claim 1, further comprising: a notification unit that notifies a higher-level monitoring device of a log at a timing when the log is stored in the log storage area. 4. The log management system according to claim 1, wherein an error time between a standard time and an internal clock is managed, and a time obtained by adding the error time to the internal clock is used as a current time of the monitoring device. A log management system comprising: a time management unit that gives the time to the determination unit and the second storage unit. 5. The log management system according to claim 4, wherein the time management unit receives a change in the standard time and changes a time obtained by changing the error time with a current time of the monitoring device. A log management method characterized by: 6. The log management system according to claim 4, wherein at least the second storage unit adds the error time to a log and stores the log in the log storage area. Management method. 7. The log management method according to claim 4 or 5, wherein the occurrence time at which the log to be output to the display unit in response to the display designation is displayed is the same as the occurrence time obtained from the log in the log storage area. A display log output unit is obtained by substituting the occurrence time acquired from the time management unit and the current error time into the following expression: occurrence time = occurrence time−error time of occurrence time + current error time. Log management method.