JPH11232145A - Log information recording device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a log information recording device which efficiently records log information to more accurately grasp the operation condition of a system using a computer, a communication equipment, etc. SOLUTION: The log information recording device 20 is provided with an event recording control part 20b, a clock 20a, a recorded event holding area 20c where event information is recorded, and an event correspondence table 20d where event classifications and error classifications are preliminarily related. The event recording control part 20b acquires the occurrence time of an event from the clock 20a and records the event in the recorded event holding area 20c together with its event classification, the occurrence time, and the error classification. The event is deleted after a prescribed time has elapsed; however, if an error event occurs, error event information is recorded for related events according to a preliminarily set condition not to delete the events related to the error event.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a log information recording device, and more particularly, to a device for recording a log generated by a system such as a computer and a communication device.

[0002]

2. Description of the Related Art In a system using a computer or a communication device, an internally generated event is recorded as a log on a recording medium in order to determine whether the system is operating normally or the operating state of the system. That is often done. The more information about these events is obtained, the more information is recorded, the more information is recorded. The time gets longer.

In a conventional log storage system, when a necessary event is referred to, no burden is imposed on the system.
As a log storage system that does not take much time,
There is a technique disclosed in Japanese Patent Publication No. 263330. In this log accumulation system, when recording an occurred log, a memory recording medium or the like is stored in a plurality of storage areas based on an occurrence condition, for example, a location of log information, an occurrence time of log information, or importance of log information. The data is divided and recorded, and an efficient search method is used when referring to the data.

[0004]

However, in the above-mentioned conventional example, it is necessary to record all generated log information in any area such as a memory or a storage medium. For this reason, the load on a system that records a large amount of log information increases. In addition, in order to reduce the load on the system, a method of recording only events of high importance is conceivable, but in that case, it is highly possible that events occurring before and after that event are not recorded, It is difficult to accurately analyze what kind of operation is being performed as a system.

[0005] The present invention has been made in view of the above-mentioned circumstances, and efficiently records log information, thereby enabling a log information recording system capable of more accurately grasping the system operation status using a computer, communication equipment, or the like. Providing the device is an issue to be solved.

[0006]

According to a first aspect of the present invention, there is provided a log information recording apparatus for recording, as log information, event information obtained from a system which is an event generation source, a clock and an event information storing the event information. A recording unit; and an event recording control unit that controls a recording state of the event in the event information recording unit. When the event occurs, the event recording control unit acquires the event type of the event and the clock from the clock. A process of recording the occurrence time of the occurrence event and an error type obtained when the occurrence event is an error event in the event information recording unit as log information in association with information representing the content of the occurrence event; Characterized by
Log information can be recorded efficiently,
This makes it easy to grasp the operation status of the system and reduce the load on the system.

According to a second aspect of the present invention, in the first aspect of the present invention, there is further provided an event correspondence table holding unit for holding an event type and an error type of an error event in advance as a table in association with each other, When the generated event is an error event, an event type corresponding to the obtained error type is extracted from the event correspondence table holding unit, and the event information recorded in the event information recording unit is stored in the event correspondence table. Determining whether or not the event type corresponds to the event type extracted from the holding unit, and performing processing for recording the determined event information in association with error event information indicating that an error event has occurred; Searching for motion and accurate analysis One in which the.

According to a third aspect of the present invention, in the first or second aspect of the invention, when an event occurs, the event recording control unit sets a predetermined one of the event information recorded in the event information recording unit. A process for deleting event information relating to an event for which a predetermined time has elapsed has been performed, so that storage means can be saved and a reasonable storage process can be performed.

According to a fourth aspect of the present invention, in the second aspect of the present invention, when the event occurs, the event recording control unit sets a predetermined one of the event information recorded in the event information recording unit. A process of deleting event information relating to an event whose time has elapsed and not recording the error event information in association with the error event information is performed, and only necessary minimum event data relating to an error is retained. This makes it possible to operate the storage means rationally and to make event analysis easier.

According to a fifth aspect of the present invention, a program for executing a process in the log information recording apparatus according to any one of the first to fourth aspects is recorded. Means are provided.

[0011]

According to the structure of the present invention, when various events are recorded, the occurrence time and the event type are recorded in the event information recording section together with the contents of the event. Of the recorded events, the occurrence time has exceeded a certain time,
If no related error event has occurred, a process of deleting the event is performed. If the event that occurred is an error event, an event type related to the error event is obtained from a preset event correspondence table, and the event related to the occurrence of the related event among the events recorded in the event information recording unit is obtained. By recording the type of error that has occurred in the error type entry, it is prevented from being deleted in the above processing. That is, for an error event that has occurred, only an event related to the error event is held, so that it is easy to grasp the operation status.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. FIG. 1 is a block diagram showing an embodiment of a log recording apparatus according to the present invention.
0 is a target system, 20 is a log recording device, 20a
Is a clock, 20b is an event recording control unit, 20c is a recorded event holding area (event information recording unit), and 20d is an event correspondence table. FIG. 2 is a block diagram for explaining an example of the configuration of the target system shown in FIG. 1. In FIG.
11a is an application, 10b and 11b are connection control units, and 10c and 11c are transmission / reception processing units. The target system 10 shown in FIG. 1 is a target of operation verification and is a generation source of a log event. The clock 20a is for acquiring the time of occurrence of an event from the target system 10. Recorded event holding area 20
c is an area for holding an event generated by the target system 10. The event correspondence table 20d is
It holds a table that associates normal events with error events.

In this embodiment, a connection-oriented communication device as shown in FIG. 2 is taken as an example of a target system. Target system 10, 1
1 is an application 10 for performing data communication
a, 11a, connection control units 10b, 11b for controlling connection with a communication partner in accordance with a connection setting request from an application, and transmission / reception processing units 10c, 11c for performing actual communication with a partner device. The log recording device 20 is connected to the connection control unit 1.
0b.

The event recording control unit 2 of the log recording device 20
In step 0b, when an event occurred in the connection control unit 10b of the target system 10 is received, the processing operation is executed according to the flowcharts shown in FIGS. 3 to 5 are flowcharts for explaining an example of a processing operation of an event that has occurred in the log recording apparatus according to the present invention. FIG. 3 shows the entire flow of the processing operation example, and FIG. 4 and 5 show the detailed operation of the recording process of the occurrence error type. Hereinafter, a specific example will be described below. It is assumed that the maximum event holding time Ta in FIG. 4 is set to 15.

The recorded event holding area 20c has four entries of the event occurrence time, the event type, the content of the occurred event, and the occurrence error type. In this embodiment, for the sake of simplicity, it is assumed that a series of transmission processing and reception processing occur alternately after the initialization processing. The occurrence time is also recorded in a simplified manner. In the following description, only one error event has occurred, but a plurality of related error events may occur for one event. In this case, only one occurrence error type entry may be prepared and the occurrence error type may be overwritten, or the error type recorded first may be prioritized. Alternatively, a plurality of error type entries may be prepared, and all related error types may be recorded.

In this embodiment, the following five event types are assumed as the event types of the events occurring in the connection control unit. In other words, the process start event type related to the initialization of the target system, the connection setting / disconnection event type when the connection is set or disconnected by the connection control unit, the message transmission request or the reception notification related to the connection setting / disconnection from the application, etc. The type of communication event with the application, the type of internal processing event that is an event inside the connection control
Also, a communication event type with a transmission / reception processing unit such as a message transmission request from a connection control unit to a transmission / reception process or a message reception communication is assumed. The error type includes a connection control unit internal error (module internal error), a transmission / reception processing unit error, and a protocol when an unsupported value is set for a parameter in a received message or an unexpected message is received. The above error is assumed.

The relationship between these event types and error types is assumed in the present embodiment as follows. The module internal error type is related to all event types. The transmission / reception processing unit error type is related only to the communication event type with the transmission / reception processing unit. The protocol error type is related to the connection setting / disconnection, communication with the application, and the event type of internal processing. These relationships are set in the event correspondence table 20d at the start of the module internal log recording as a table as shown in FIG. These may be classified in consideration of the meaning of each event, or the target module may be further subdivided and classified according to the place of occurrence.

FIG. 7 is a view showing an example of a recorded event area when an event is recorded without an error in the log recording apparatus according to the present invention. The contents are shown in FIG. 7A, FIG. 7B, and FIG. 7C in chronological order. First, as shown in FIG. 7A, a process initialization event occurs first at an occurrence time “0” in the target system. Since this event is not an error event, the event recording control unit 20b executes an event deletion process shown in FIG. In the event deletion process,
First, as the target event, the oldest event among the events already recorded is targeted. However, since there is no event at this point, the process is terminated without any processing. It is recorded in the recorded event holding area 20c together with the type.

As shown in FIG. 7A, when the process registration event occurs at the occurrence time 1, the process initialization event occurrence time of the occurrence time “0” already recorded is compared with the current time. Since the time difference between the two is smaller than the maximum event holding time Ta, the event at the occurrence time “0” is not deleted. At this time, since the next event is empty, the currently registered process registration event occurrence time “1” is recorded in the recorded event holding area together with the event type “1”. After that, until the communication notification event from the transmission / reception processing unit at the occurrence time "13", each event is recorded in the recorded event holding area 20c through the same processing as described above, and the state shown in FIG.

Further, when a received message analysis event occurs at the occurrence time "15", the event recording control unit determines whether the event is an error event. Here, since the event is not an error event, an event deletion process is performed. In the event deletion process, it is determined whether or not the occurrence error type entry is empty for the event that has already been recorded. It can be seen that among the recorded events, the process initialization event of the occurrence time “0” has an empty entry of the occurrence error type. Next, the difference between the current time and the occurrence time of the process initialization event is confirmed. The current time is “15”, and the difference from the occurrence time “0” is the maximum event holding time T
Since it is not smaller than a, the process initialization event at the occurrence time “0” is deleted. At this time, for the process registration event with the occurrence time “1”, the occurrence error type is empty, but the difference between the current time and the occurrence time “1” of the process registration event is smaller than the maximum event holding time Ta. However, this event is not deleted. Or later,
Similarly, the event is not deleted until the reception buffer securing event at the occurrence time “14”, and the state is as shown in FIG. 7B.

Further, when an event for notifying the application of the received data occurs at the occurrence time “16”, the process registration event at the occurrence time “1” has an empty entry of the occurrence error type, and the same as the occurrence time. Since the difference is not smaller than Ta, it is deleted and the other events are retained. FIG. 7C shows this state.

FIG. 8 is a diagram showing an example of processing when an internal error has occurred in the log information recording apparatus according to the present invention. FIG. , FIG. 8 (B), and FIG. 8 (C). In the state of FIG. 8A, a reception notification event from the transmission / reception processing unit at the occurrence time “13” is recorded. The connection control unit of the target system performs a reception buffer securing process. If this process fails due to lack of resources or the like, a reception buffer securing failure event occurs. The event recording control unit that receives this event at the occurrence time “14” performs the occurrence error type recording process shown in FIG. 5 because the received event is an error event.

In the occurrence error type recording process, first, the process initialization event of the occurrence time “0”, which is the oldest event among the recorded events, and the process start event type of the event type “1” are targeted. Get. Next, from the event correspondence table, it can be seen that the module internal error of the error type “a” is an event related to the process activation event type of the event type “1”. Accordingly, the error type “a” is recorded in the occurrence error type entry of the process initialization event at the occurrence time “0”. Thereafter, until the notification of the occurrence time “13” from the transmission / reception processing unit, if the error type “a” is applicable, the error type “a” is recorded in the occurrence error type entry, and as shown in FIG. Become. In this embodiment, since the module internal error is related to all events, as a result, when this error occurs, all the events recorded at that time become related events.

When a transmission request from the application at the occurrence time “16” is received, the event recording control unit performs an event deletion process. In the process initialization event of the occurrence time “0”, the difference between the current time and the occurrence time is larger than the maximum event holding time Ta, but a related error occurs, and the error type “a” is recorded in the occurrence error type entry. Are not deleted. Each event that has occurred thereafter is not deleted in the same way, and becomes a state as shown in FIG.

FIG. 9 is a diagram showing an example of processing in the case where an error occurs in the transmission / reception processing unit in the log information recording apparatus according to the present invention. (A), FIG. 9 (B), and FIG. 9 (C). In the state of FIG. 9A, up to the transmission message assembly event at the occurrence time “7” is recorded in the recorded event holding area. When the transmission fails in the transmission / reception processing unit of the target system at the occurrence time “8”, a transmission request failure event is input from the connection control unit of the target system to the event recording control unit. Is performed.
The error type at this time is the transmission / reception processing unit error of the error type “b”, and it can be seen from the event correspondence table of FIG. 6 that the error type is related to the communication event with the transmission / reception processing unit of the event type “5”. Since the related event among the events recorded in the recorded event area is the transmission buffer securing event of the occurrence time “6”, the error type “b” is added to the occurrence error type entry of this event.
Record After that, the transmission request impossible event to the transmission / reception processing unit at the current occurrence time “8” is recorded in the recorded event holding area together with the occurrence time, event type, and occurrence error type. As a result, a state as shown in FIG. 9B is obtained.

When a series of transmission processing events from the transmission request acceptance event from the application at the occurrence time “11” to the transmission request to the transmission / reception processing unit at the occurrence time “14” occurs, the event is recorded in the already recorded event holding area. Since all of the recorded events are events that occurred within the maximum event holding time Ta, the recorded state is maintained.

However, when the reception notification event from the transmission / reception processing unit occurs at the occurrence time “19”, the holding time of the process initialization event of the occurrence time “0” and the process registration event of the occurrence time “1” is the maximum. Since the error holding time is longer than the event holding time Ta and no related error event has occurred, the generated error type entry is empty. Therefore, these two events are deleted, and the other events remain recorded. When the reception buffer securing event of the occurrence time “20” occurs, the holding time of the transmission request acceptance event from the application of the occurrence time “5” is the maximum event holding time Ta.
Since the length is longer and the occurrence error type entry is empty, the event at the occurrence time “5” is deleted.

When the received message analysis event at the occurrence time "21" occurs, the holding time of the transmission buffer securing event at the occurrence time "6" becomes longer than the maximum event holding time Ta. Since the error type “b” is recorded in the type entry, it is not deleted. When a notification event to the application of the received data at the occurrence time “22” occurs, the holding time of the transmission message assembly event at the occurrence time “7” becomes longer than the maximum event holding time Ta, and the occurrence error type entry is also empty. Because
This transmission message assembly event is deleted. Therefore, the event held at this point is as shown in FIG.
become that way.

FIG. 10 is a diagram showing an example of processing when a protocol error type event occurs in the log information recording apparatus according to the present invention, and FIG. ), FIG. 10 (B), FIG.
0 (C). In the state shown in FIG. 10A, the reception buffer securing event at the occurrence time “14” from the process initialization event at the occurrence time “0” has already been recorded in the recorded event holding area. Here, when a received message analysis error occurs at the occurrence time “15”, the error type at this time is the protocol error type, and from the event correspondence table in FIG. 6, the protocol error type is the connection of the event type “2”. It can be seen that there are three event types related to the setting / disconnection event type, the communication event type with the application of the event type “3”, and the internal processing event type of the event type “4”. Among the recorded events, the event related to these three event types is the occurrence time “5”.
These are three events: a transmission request reception event from the application, an outgoing message assembly event at the occurrence time “7”, and a reception buffer securing event at the occurrence time “14”. "Is recorded. At this point, the result is as shown in FIG.

When a transmission request acceptance event from the application occurs at occurrence time "20", a process initialization event at occurrence time "0" and an occurrence time "1"
Are longer than the maximum event holding time Ta and the occurrence error type entry is empty, so these events are deleted. On the other hand, the holding time of the transmission request acceptance event from the application with the occurrence time “5” is also longer than the maximum event holding time Ta, but the event with the occurrence time “5” has the error type “c” in the occurrence error type entry. It is recorded and will not be deleted.

Even when the transmission buffer securing event at the occurrence time "21" occurs, the transmission request acceptance event from the application at the occurrence time "5" whose holding time is longer than the maximum event holding time Ta is indicated by an error in the occurrence error type entry. Since the type “c” is recorded, it is not deleted, but for the transmission buffer securing event of the occurrence time “6” in which the holding time is longer than the maximum event holding time Ta, the occurrence error type entry is empty. Therefore, it is deleted. The recorded event immediately after the occurrence of the transmission request event to the transmission / reception processing unit at the occurrence time “23” is as shown in FIG.

Next, an embodiment of a means for providing a program and data used for causing the log information recording apparatus according to the present invention to function will be described below. This means is provided as a recording medium storing a program and data for causing the above-described log information recording apparatus to function. Specific examples of the recording medium include a ROM (Read Only Memory), a flash memory, a floppy disk, a hard disk, a magneto-optical disk,
A D-ROM or the like can be assumed. By circulating a recording medium on which programs and data are recorded in the above-described manner, the functions of the apparatus can be easily executed. By installing such a recording medium in an information processing apparatus such as a computer and reading out such programs and data from the recording medium, the functions of the log information recording apparatus can be easily executed.

[0033]

According to the first aspect of the present invention, log information can be efficiently recorded by storing event information, event occurrence time, event type, and error type in association with each other as log information. Thereby, it is easy to grasp the operation state of the system, and it is possible to reduce the load on the system.

According to the second aspect of the invention, in addition to the effect of the first aspect, by recording error information in an event related to an error event that has occurred, a search for an operation relating to the error event and accurate analysis can be performed. .

According to the third aspect of the invention, in addition to the first or second aspect, by executing a process of deleting an event after a lapse of a predetermined time, storage means can be saved and a reasonable storage process can be performed. it can.

According to the fourth aspect of the invention, in addition to the effect of the second aspect, by recording the error type in the event related to the error event, only the minimum necessary event data related to the error can be held. , The storage means can be rationally operated, and the event analysis can be made easier.

According to a fifth aspect of the present invention, there is provided a recording medium on which data and a program for executing processing in the log information recording apparatus according to the first to fourth aspects are recorded, which is effective for making the apparatus easily function. Means are provided.

[Brief description of the drawings]

FIG. 1 is a block diagram showing an embodiment of a log recording device according to the present invention.

FIG. 2 is a block diagram for explaining a configuration example of a target system shown in FIG. 1;

FIG. 3 is a flowchart for explaining an example of a processing operation of an event that has occurred in the log recording apparatus according to the present invention.

FIG. 4 is a flowchart for explaining an example of a processing operation of an event that has occurred in the log recording apparatus according to the present invention.

FIG. 5 is a flowchart illustrating an example of a processing operation of an event that has occurred in the log recording device according to the present invention.

FIG. 6 is a diagram showing a setting example of an event correspondence table indicating an association between each event type and an error event type;

FIG. 7 is a diagram illustrating an example of a state of a recorded event area when an event is recorded without an error in the log recording device according to the present invention.

FIG. 8 is a diagram showing an example of processing when an internal error occurs in the log information recording device according to the present invention.

FIG. 9 is a diagram illustrating an example of processing when an error occurs in a transmission / reception processing unit in the log information recording device according to the present invention.

FIG. 10 is a diagram illustrating an example of processing when a protocol error type event occurs in the log information recording device according to the present invention.

[Explanation of symbols]

10, 11 target system, 10a, 11a application, 10b, 11b connection control unit, 10c, 11c transmission / reception processing unit, 20 log recording device, 20a clock, 20b event recording control unit, 20
c: recorded event holding area (event information recording unit), 20d: event correspondence table.

Claims (5)

[Claims] 1. A log information recording device that records event information obtained from a system that is an event generation source as log information, a clock, an event information recording unit that stores event information, and an event in the event information recording unit. An event recording control unit for controlling a recording state of the event, the event recording control unit, when an event occurs, an event type of the event, an occurrence time of the occurrence event obtained from the clock, and the occurrence event A log information recording device for performing a process of associating an error type obtained when is an error event with information representing the content of the generated event as log information in the event information recording unit. 2. An event correspondence table holding unit which holds an event type and an error type of an error event in advance in association with each other as a table, wherein the event recording control unit is configured to execute the processing when the generated event is an error event. Extracting an event type corresponding to the obtained error type from the event correspondence table holding unit, and determining whether the event information recorded in the event information recording unit corresponds to the event type extracted from the event correspondence table holding unit 2. The log information recording apparatus according to claim 1, wherein a process of discriminating the event information and recording the event information in association with the discriminated event information indicating that an error event has occurred is performed. 3. A process for deleting, when an event has occurred, event information relating to an event for which a predetermined time has elapsed from among event information recorded in the event information recording unit, when the event has occurred. 3. The log information recording device according to claim 1, wherein 4. The event recording control unit, when an event occurs, among event information recorded in the event information recording unit, event information relating to an event that has passed a predetermined time, and 3. The log information recording device according to claim 2, wherein a process of deleting event information in which the error event information is not recorded in association with the error event information is performed. 5. A computer-readable recording medium in which a program for executing a process in the log information recording device according to claim 1 is recorded.