KR101609915B1 - Method and apparatus for multi dimension time gap analysis - Google Patents

Abstract

A method and apparatus are provided for analyzing a plurality of event logs. A method and apparatus for analyzing a plurality of event logs may index a plurality of event logs into each of a plurality of dimensions. A method and apparatus for analyzing a plurality of event logs can detect a central event log corresponding to one or more dimensions obtained based on indexed information and information relating to the central event log can be output.

Description

[0001] METHOD AND APPARATUS FOR MULTI DIMENSION TIME GAP ANALYSIS [0002]

TECHNICAL FIELD [0002] The present invention relates to techniques for analyzing event logs, and more particularly, to a method and apparatus for multi-dimensionally analyzing event logs using multidimensional sources.

With the high performance and high capacity of the computing system, a lot of data may be collected. Various techniques can be applied to more efficiently use or analyze the collected data. A database can be information that extracts, transforms, integrates, or summarizes data from various operating systems to help users make decisions.

As data becomes larger, search techniques may be needed to efficiently manage the data. However, the conventional keyword-based information retrieval method can not play a role of efficient management of data due to an exponential increase of information. In addition, semantic search, sentiment analysis search, and user experience search may be developed by the search technology. Text mining is a required technique for such retrieval techniques and many category extraction methods may be used.

Korean Patent Laid-Open No. 10-2011-005402 (published on June 07, 2011) discloses an invention relating to a data analysis technique of an electronic civil affairs bulletin board. The data analysis method of the electronic civil affairs bulletin board according to the disclosed technology includes a database engine that can store information about the bulletin board creator and statically constructed data (hereinafter, static data) based on the bulletin board author and data mining (Hereinafter, referred to as " dynamic data "), which can be connected to a data mining engine. (A) selecting at least a part of finite subjects (hereinafter referred to as an analysis topic set) for analysis of the electronic petition bulletin board; and (b) Determining whether each of the at least one subject (hereinafter referred to as the first subject) is associated with at least a portion of the static data. Thus, the disclosed technique is economical and can analyze data with high efficiency

One embodiment may provide an apparatus and method for detecting dimensions that are expected to cause problems by analyzing a plurality of event logs.

One embodiment may provide an apparatus and method for analyzing a relationship between event logs within a dimension by indexing a plurality of event logs into each of a plurality of dimensions.

In one aspect, the method includes analyzing a plurality of event logs, each event log of the plurality of event logs having a record of each of a plurality of dimensions associated with an event of the event log - indexing the plurality of event logs into each of the plurality of dimensions based on the analysis, obtaining one or more dimensions that are expected to have a problem among the plurality of dimensions, Comprising the steps of: detecting at least one central event log corresponding to the acquired one or more of the event logs of the event log; and outputting information relating to the detected at least one central event log / RTI >

The one or more dimensions that are expected to cause the problem may be one or more of the dimensions associated with the event if the actual execution time of the event is longer than a predetermined time set for the time at which the event is performed.

The outputting may be performed by graphing information related to the at least one central event log.

The event log analysis method may further include receiving an additional event log.

Analyzing the plurality of event logs may add the received additional event logs to the plurality of event logs and analyze the plurality of event logs to which the additional event logs have been added.

The analyzing may analyze the plurality of event logs by extracting a record of each of the dimensions associated with the event of each event log.

The indexing may index the plurality of event logs into each of the plurality of dimensions based on a time stamp of each event log.

If there are event logs having the same dimension and the same time stamp among the plurality of event logs, the event logs may be indexed based on a predetermined process order set on the same dimension.

The indexing may index the plurality of event logs into each of the plurality of dimensions using a hash data structure.

The event log analysis method may further include acquiring information indicating a step associated with the at least one central event log.

 Indexed event logs for each of the one or more dimensions may each have a step associated with the at least one central event log.

The event log analysis method may further comprise detecting one or more higher event logs and lower event logs corresponding to the information indicated by the information among the indexed event logs for each of the one or more dimensions.

The outputting may output a graph in which the at least one central event log is associated with the at least one higher event logs and the lower event logs.

The graph may be associated with the at least one central event log, wherein the one or more higher event logs and sub event logs are divided into respective dimensions of the one or more dimensions.

The at least one central event log may be multiple.

The event log analysis method may further include determining that a problem has occurred in the event related to the connection when all or a part of the central event logs of the plurality of central event logs are connected to each other.

The analyzing of the plurality of event logs may analyze a time difference between the plurality of event logs based on a time stamp of each event log.

The indexing may index the plurality of event logs using the analyzed time difference.

Wherein analyzing the plurality of event logs may analyze only event logs comprising at least one dimension of the predetermined dimensions.

The predetermined dimensions may be included in the plurality of dimensions.

Wherein analyzing the plurality of event logs may analyze the time difference between event logs comprising a dimension of the same process instance identification among the plurality of dimensions.

The event log analysis method may further include outputting a time difference between the first event log and the second event log.

The received one or more dimensions may be the first dimension and the second dimension.

The detecting may detect a first event log including the first dimension and a second event log including the second dimension.

The outputting of the information may output the first event log and the second event log as the at least one central event log.

The outputting of the time difference may include outputting the plurality of time differences in a sequence in which the first event log and the second event log have a plurality of time differences and the plurality of time differences have a plurality of time differences.

The outputting of the information may output a graph indicating a connected relationship between the first event log and the second event log when the time difference exceeds a predetermined time.

The predetermined time may be set differently based on the first dimension and the second dimension.

The event log analysis method may further include acquiring and receiving information for selecting the output time difference.

The step of outputting the information may output a graph indicating a relationship between the first event log and the second event log for the selected time difference.

The event log analysis method may further include obtaining information indicating a step connected to the first event log and the second event log, respectively.

Indexed event logs for each of the one or more dimensions may each have steps associated with the first event log or the second event log.

The event log analysis method may further include detecting at least one upper event logs and lower event logs corresponding to the information indicated by the information among the indexed event logs for each of the one or more dimensions.

The outputting of the information may output a graph in which the first event log and the second event log are associated with the one or more higher event logs and the lower event logs, respectively.

Wherein the event log analysis method further comprises: when the first event log and the second event log are connected through an event log of at least one of the one or more upper event logs and the lower event logs, It may be determined that there is an error.

In another aspect, a method is provided for analyzing a plurality of event logs, each event log of the plurality of event logs having a record of each of a plurality of dimensions associated with an event of the event log Indexing the plurality of event logs into each of the plurality of dimensions based on the analysis, obtaining one or more dimensions budgeted to be a problem among the plurality of dimensions, A processor for detecting at least one central event log corresponding to the acquired one or more of the logs and for outputting information associated with the detected at least one central event log.

An apparatus and method for analyzing dimensions that are expected to cause problems using a plurality of dimensions are provided.

An apparatus and method for detecting a delayed event in the process of processing port logistics is provided.

1 is a conceptual diagram of a process of processing port logistics according to an example.
Figure 2 shows the code of an event log according to an example.
3 shows a configuration diagram of an electronic device according to an embodiment.
4 illustrates a flow diagram of a method for analyzing event logs in accordance with one embodiment.
5 illustrates a flow diagram of a method for analyzing a plurality of event logs in accordance with an example.
6 shows a flow diagram of a method for indexing a plurality of event logs in accordance with an example.
Figure 7 shows a flow diagram of a method for indexing a plurality of event logs per dimension according to an example.
Figure 8 shows a method for generating a plurality of dimensions according to an example and a code for indexing a plurality of event logs.
FIG. 9 illustrates a plurality of dimensions indexed by a plurality of event logs according to an example.
FIG. 10 shows information about an event log indexed to a selected one of a plurality of dimensions according to an example.
FIG. 11 shows information about a detected central event log corresponding simultaneously to one or more dimensions according to an example.
12 shows a flow diagram of a method for detecting a top event log and a sub event log of a central event log according to an example.
13 shows a flow diagram of a method for detecting an upper event log and a lower event log according to an example.
14 shows a code for detecting a central event log, a parent event log, and a sub event log according to an example.
FIG. 15 shows a code for detecting an upper event log and a lower event log according to an example.
FIG. 16 shows a code for generating a node of a central event log, a node of a parent event log, and a node of a child event log according to an example.
FIG. 17 shows a code for connecting nodes of a central event log and nodes of a parent event log and nodes of a sub event log according to an example.
Figure 18 shows a code for reconstructing the style of a node according to an example.
FIG. 19 shows a graph of the relationship of the upper event logs and the lower event logs with each of the central event logs, when the step represented by the information according to an example is 1. FIG.
FIG. 20 shows a graph of the relationship of the upper event logs and the lower event logs with each of the central event logs, when the step represented by the information according to an example is 2. FIG.
Figure 21 shows a graph of the relationship of the top event logs and the sub event logs with each of the central event logs when the step represented by the information according to an example is three.
FIG. 22 shows a graph of the relationship of the upper event logs and the lower event logs with each of the central event logs, when the step represented by the information according to an example is 4. FIG.
23 illustrates a flow diagram of a method for analyzing event logs in accordance with one embodiment.
FIG. 24 shows a flowchart of a method of outputting a graph indicating a connection relationship between a first event log and a second event log according to an example.
FIG. 25 shows a flowchart of a method of outputting a graph in which a first event log and a second event log according to an example are linked to respective upper event logs and a lower event log.
FIG. 26 shows the time difference between the first event log and the second event log according to an example.
27 is a graph illustrating a connection relationship between a first event log and a second event log according to an example.
FIG. 28 shows a graph of the relationship of the upper event logs and the lower event logs with each of the first event log and the second event log, when the step represented by the information according to an example is 1. FIG.
FIG. 29 shows a graph of the relationship of the upper event logs and the lower event logs with each of the first event log and the second event log, when the step represented by the information according to an example is 2. FIG.
FIG. 30 shows a graph of the relationship of the upper event logs and the lower event logs with each of the first event log and the second event log, when the step represented by the information according to an example is 3. FIG.
FIG. 31 shows the time difference between the first event log and the second event log according to an example.
FIG. 32 shows a graph of the relationship of the upper event logs and the lower event logs with each of the first event log and the second event log, when the step represented by the information according to an example is 5;
33 illustrates time differences between the first event log and the second event log according to an example.
FIG. 34 shows a graph of the relationship of the upper event logs and the lower event logs with each of the first event log and the second event log, when the step represented by the information according to an example is 3. FIG.
FIG. 35 illustrates a time difference between the first event log and the second event log according to an example.
FIG. 36 shows a graph of the relationship of the upper event logs and the lower event logs with each of the first event log and the second event log, when the step represented by the information according to an example is 2. FIG.

In the following, embodiments will be described in detail with reference to the accompanying drawings. Like reference symbols in the drawings denote like elements.

Various modifications may be made to the embodiments and may have various embodiments, and specific embodiments are illustrated in the drawings and described in detail in the description. It is to be understood, however, that the intention is not to limit the embodiments to the embodiments, but to include all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

The terms used in the examples are used only to illustrate specific embodiments and are not intended to limit the embodiments. The singular expressions include plural expressions unless the context clearly dictates otherwise. In the present application, the terms "comprises" or "having" and the like are used to specify that there is a feature, a number, a step, an operation, an element, a component or a combination thereof described in the specification, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this embodiment belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the contextual meaning of the related art and are to be interpreted as either ideal or overly formal in the sense of the present application Do not.

In the following description of the present invention with reference to the accompanying drawings, the same components are denoted by the same reference numerals regardless of the reference numerals, and redundant explanations thereof will be omitted. In the following description of the embodiments, a detailed description of related arts will be omitted if it is determined that the gist of the embodiments may be unnecessarily blurred.

1 is a conceptual diagram of a process of processing port logistics according to an example.

The process of handling port logistics can be a complex process. The process of handling port logistics can be the execution of many activities. Each activity can contain attributes.

The flow of port logistics can be supported by the terminal operation system. The terminal operating system may store a history of the logistics flow. Thus, a complete history of what actually happened within the port logistics can be found in the system. Processes in the processing of logistics can be distinguished in several respects. For example, processes can be distinguished by aspects of activity, aspects of equipment, aspects of properties, and non-equipment aspects.

Since one activity in the port logistics process can be linked to another activity, the preceding activity can have a strong impact on the following activities. Due to the strong association between activities, delays in previous activities can delay or negatively impact the next activity. Delays in these advanced activities can occur due to waiting equipment. For example, a container discharging activity may be delayed because a gantry crane or a quay crane is waiting for a yard truck. In this case, the delay may be caused by yard trucks, not keycranes. Therefore, when analyzing the time gap of equipment, aspects of activity and equipment may need to be considered at once to obtain more accurate results.

An event log of data including case identifiers, activity names, activity types, resources, time stamps, and other attributes, May be an input to the process mining technique. The event log may be stored in the terminal operating system. You can generate other data if you analyze the event log from various perspectives, rather than from one viewpoint.

Conventional temporal analysis can analyze time differences between two selected activities, but can only be analyzed from the perspective of activity.

The present invention is capable of analyzing processes performed through a plurality of dimensions in terms of time difference analysis. A method of analyzing an event log through a plurality of dimensions will be described in detail below with reference to Figs. 2 to 38. Fig.

Figure 2 shows the code of an event log according to an example.

The work-flow-log may include a plurality of event logs. The workflow log or event log can be stored in the terminal operating system.

The event log 220 or 230 may be a record of activity for a container identified by a process instance ID 240. The process instance ID may be a case ID.

The event log 220 may include at least one of an activity 244 performed, an event type 246, a timestamp 248 where the event log was generated, equipment 250 associated with the activity, and an attribute 242 . A plurality of activities related equipment 250 may be provided. The event log 220 may include information on each device of a plurality of devices.

A process instance ID 240, an activity 244, an equipment 250 associated with the activity 244, an event type 246, an attribute 242 and a time stamp 248 of the event log generated Each can be a dimension. The dimensions are described in detail below with reference to FIG.

Hereinafter, the terms "activity" and "event" may be used interchangeably and may be interchanged with each other.

The technical contents described above with reference to FIG. 1 can be applied as it is, so a detailed description will be omitted below.

3 shows a configuration diagram of an electronic device according to an embodiment.

The electronic device 300 may include a communication unit 310, a processing unit 320, and a storage unit 330.

The communication unit 310 may receive the workflow log or the event log 220 from the terminal operation system. For example, the communication unit 310 may receive a plurality of event logs 220 and 230.

The storage unit 330 may receive the received workflow log or the event log 220. The storage unit 330 may store the data received by the communication unit 310 and the data generated by the processing unit 320. [

The communication unit 310, the processing unit 320, and the storage unit 330 will be described in detail below with reference to FIG. 4 to FIG.

The technical contents described above with reference to Figs. 1 and 2 can be applied as they are, so that a more detailed description will be omitted below.

4 illustrates a flow diagram of a method for analyzing event logs in accordance with one embodiment.

In step 410, the processing unit 320 may analyze a plurality of event logs. Each event log of a plurality of event logs may include a record of each of the plurality of dimensions associated with the event of the event log.

A plurality of dimensions are described in the following [Table 1].

Dimension Description of dimension CASE_ID Process instance ID EVENT NAME Event name EVENT NAME & TYPE A pair of event name and event type TIMESTAMP Timestamp of event HOUR_INTERVAL Timestamp of every hour interval DATE INTERVAL Timestamp of date interval RESOURCE Equipment, eg) Key crane (pixID), yard crane (YC_ID), yard truck (YT_ID) PERFORMER Operator, eg) Driver of yard truck (DRIVER) LOCATION (ROW_ID) in the yard block position, the tire number (TIER) in the yard block position, the bay number (BAY) in the yard block position, the container into the port (TRANSPORT_IN), the equipment (TRANSPORT_OUT) that takes the container out of the port, the position of the container in the ship (HATCH)

The processing unit 320 may analyze the plurality of event logs by extracting a record of each of the dimensions associated with the event of each event log.

A method of analyzing a plurality of event logs will be described in detail below with reference to FIG.

At step 420, the processing unit 320 may index a plurality of event logs in each of the plurality of dimensions based on an analysis of the plurality of event logs.

According to one embodiment, the processing unit 320 may generate data indexing a plurality of event logs. The indexed data may be data in which the positions of event logs including the above dimension are recorded by dimension. The processing unit 320 can quickly search a necessary event log by recording the location of the event logs.

A method of indexing a plurality of event logs will be described in detail below with reference to FIGS. 6 to 9.

In step 430, the communication unit 310 may receive an additional event log from the terminal operating system.

The processing unit 320 may determine whether an additional event log has been received.

If additional event logs are received, steps 410 and 420 may be performed again to analyze additional event logs.

For example, in step 410 of analyzing a plurality of event logs, the processing unit 320 may add the received additional event logs to a plurality of event logs. At step 410, the processing unit 320 may analyze a plurality of event logs to which additional event logs have been added.

In step 420, the processing unit 320 may index the added event log. For example, the indexed data of a plurality of event logs can be updated by indexing the added event logs.

In step 440, the processing unit 320 may obtain one or more of the plurality of dimensions.

According to one embodiment, the processing unit 320 may obtain one or more dimensions of a plurality of dimensions that are expected to have a problem. For example, the processing unit 320 may determine one or more of the dimensions associated with the event as a dimension in which the problem is expected when the actual execution time of the event has passed a predetermined time set for the event . In other words, the one or more dimensions that are expected to have a problem may be one or more of the dimensions associated with the event if the actual actual performance time of the event is longer than the predetermined time set for the time at which the event is performed.

According to another embodiment, the processing unit 320 may obtain one or more dimensions by receiving one or more of a plurality of dimensions from a user of the electronic device 300. [

At step 450, the processing unit 320 may detect at least one central event log corresponding to one or more dimensions obtained from the plurality of indexed event logs.

For example, the processing unit 320 may detect at least one central event log corresponding to at least one of the plurality of event logs simultaneously using data indexed from a plurality of event logs.

In step 460, the processing unit 320 may output information related to at least one central event log. For example, the processing unit 320 may output only the CASE_ID among the dimensions included in the at least one central event log and information related to the one or more dimensions obtained.

For example, the processing unit 320 may graph information relating to at least one central event log. The communication unit 310 can output the graphical information.

Hereinafter, the information related to the outputted event logs can be understood or described as an event log.

A method for outputting information related to at least one central event log will be described in detail below with reference to FIG.

The technical contents described with reference to Figs. 1 to 3 can be applied as it is, and a detailed description will be omitted below.

5 illustrates a flow diagram of a method for analyzing a plurality of event logs in accordance with an example.

The above-described step 410 with reference to FIG. 4 may include the following steps 510 to 530.

At step 510, the processing unit 320 may generate a plurality of dimensions from a plurality of analyzed event logs.

At step 520, the processing unit 320 may determine whether additional dimensions should be generated if additional events are received. For example, if the received additional event includes an additional dimension, rather than a previously generated dimension, the processing unit 320 may determine that an additional dimension should be created.

At step 530, the processing unit 320 may create additional dimensions if additional dimensions need to be created.

The technical contents described above with reference to Figs. 1 to 4 can be applied as they are, so that a more detailed description will be omitted below.

6 shows a flow diagram of a method for indexing a plurality of event logs in accordance with an example.

Step 420 described above with reference to FIG. 4 may include the following steps 610 - 620.

In step 610, the processing unit 320 may index a plurality of events with each of the plurality of generated dimensions.

In step 620, the processing unit 320 may index a plurality of event logs in each of the plurality of dimensions based on a timestamp of each event log. For example, the processing unit 320 may index event logs in each dimension by arranging event logs in each dimension in the order of time stamps.

When there are events having the same dimension and the same time stamp among a plurality of event logs, the processing unit 320 may index event logs in each dimension based on a predetermined processing order set on the same dimension.

For example, if two event logs have the same CASE_ID and the same timestamp, the processing unit 320 may index the two event logs according to the event of each event log. The preceding event may be indexed to a higher rank than the following event. The order of the events can be the order of processing the logistics.

As another example, if there are events of the same dimension and the same timestamp among a plurality of event logs, the processing unit 320 may use a hash data structure to generate a plurality of event logs Can be indexed.

The technical contents described above with reference to Figs. 1 to 5 may be applied as they are, so that a more detailed description will be omitted below.

Figure 7 shows a flow diagram of a method for indexing a plurality of event logs per dimension according to an example.

A chart 710 of FIG. 7 may be a diagram that classifies a plurality of event logs based on a process instance identifier and an event identifier. The process instance identifiers 1, 2, and 3 may represent three CASE_IDs, respectively. 1, 2, 3, and 4 of the event identifiers include an activity (DispatchDischargeQuay) informing the start of the unloading operation by the key crane, an activity (CompleteDischargeQuay) of completion of the unloading operation of the key crane, an activity (DispatchDischargeYard) (CompleteDischargeYard) of the unloading operation of the truck. An event may be performed in the order of 1, 2, 3, and 4 of the event identifier for the same process instance identifier.

The same arrows can indicate the order in which they are performed within the same dimension. For example, arrows may indicate the order in which events are performed within the same CASE_ID, same activity, or dimension of the same equipment.

The processing unit 320 may index a plurality of event logs in each of the plurality of dimensions. For example, the processing unit 320 may index (730) a plurality of event logs for the same activity. As another example, the processing unit 320 may index (740) a plurality of event logs for the same resource.

Indexing may be to associate the location of event logs or the coordinates of event logs indexed to a particular dimension with a particular dimension. For example, in FIG. 7, the order of the process instance identifiers may be the x-axis coordinates, and the order of the event identifiers may be the y-axis coordinates. In this case, the event log having an order of the process instance identifier of 1 and an event identifier of 1 may have coordinates of (1, 1).

The technical contents described above with reference to Figs. 1 to 6 can be applied as they are, so that a more detailed description will be omitted below.

Figure 8 shows a method for generating a plurality of dimensions according to an example and a code for indexing a plurality of event logs.

In the following code, "PI" may represent a collection of process instances in a plurality of event logs. "ATE" may represent a collection of events corresponding to a particular process instance in a plurality of event logs. "DIM" can represent a set of dimensions. "dim.Name ()" can represent the name of the dimension. "dim.KeySet ()" may be a set of values of a dimension. "dimKey" may be a dimension value. "pi.ID ()" may represent the process instance identifier of the event log. "ate.ID ()" may be an identifier or number of the event log assigned to the event log. "dim.Value ()" may be a list of pairs of "pi.ID ()" and "ate.ID ()". "entry.value (). ate" can represent the value assigned to a specific event. "TimeStamp ()" can represent the time stamp of the event.

The value of a dimension may be a subdivided dimension within a particular dimension. For example, if YT_ID is a dimension, then the granular dimension may be the number of each yard truck in YT_ID.

Code 810 may be code for performing step 410 described above.

According to one embodiment, a plurality of dimensions to be indexed from a user of the electronic device 300 may be received. In code 810, "For each dimension categories selected by user do" may be a code that determines whether a plurality of dimensions have been selected by the user of electronic device 300 to be created. If all of the plurality of dimensions are not selected by the user, they can be added to the plurality of dimensions by creating a dimension that has not been created.

Code 820 may be code for performing step 610 described above.

In the code 820, the code "For aεA do" can be understood to be repeatedly performed for each a element belonging to the A set. For example, "For each pi∈PI do" may be code that is repeatedly executed for each process instance of a set of process instances.

Code 830 may be code for performing step 620 described above.

The processing unit 320 can index a plurality of event logs based on timestamps by executing codes 810 to 830. [

The technical contents described with reference to Figs. 1 to 7 can be applied as they are, so that a more detailed description will be omitted below.

FIG. 9 illustrates a plurality of dimensions indexed by a plurality of event logs according to an example.

According to one embodiment, data in which a plurality of event logs are indexed may be provided.

The electronic device 300 may provide an interface that can output a plurality of dimensions indexed 910 using data.

The communication unit 310 may display the number of event logs indexed in each dimension of the plurality of dimensions 910 through the interface.

In addition, the communication unit 310 may select one or more dimensions 920 of the plurality of dimensions 910 output from the user of the electronic device 300 via the interface.

The technical contents described above with reference to Figs. 1 to 8 can be applied as they are, so that a more detailed description will be omitted below.

FIG. 10 shows information about an event log indexed to a selected one of a plurality of dimensions according to an example.

According to one embodiment, the communication unit 310 may receive one or more dimensions via an interface.

The processing unit 320 may search the event log including all of the received one or more dimensions. For example, the processing unit 320 may retrieve an event log that includes all of the dimensions of an event name and a type of event (NAME & TYPE), a time of each time interval (HOUR_INTERVAL), and a yard block storage name (BLOCK) . NAME & TYPE can have the same meaning as EVENT NAME & TYPE described above.

For example, there can be one event log 1010 including dimensions 1002 where NAME & TYPE is start - complete, HOUR INTERVAL is satisfied, and BLOCK is 4G.

As another example, there can be 13 event logs 1012 including dimensions 1004 where NAME & TYPE is DispatchLoadYard - complete, HOUR INTERVAL is satisfied, and BLOCK is 7C. If there are a plurality of event logs 1012 searched for, it may be output based on the time stamp of each event log.

Additionally, in the embodiment of FIG. 10, an event log 1014 including dimensions 1006 may be retrieved. An event log 1016 containing dimensions 1008 may be retrieved.

The technical contents described with reference to FIGS. 1 to 9 can be applied as they are, so that a more detailed description will be omitted below.

FIG. 11 shows information about a detected central event log corresponding simultaneously to one or more dimensions according to an example.

11 shows information 1030 and 1040 related to at least one central event log output, according to one embodiment. Hereinafter, the information related to the outputted central event log can be outlined as "central event log ".

In the above-described step 440, the processing unit 320 may obtain one or more dimensions 1110 and 1120. For example, communication unit 310 may receive one or more dimensions 1110 and 1120 from a user via an interface.

For example, the acquired one or more dimensions 1110 and 1120 may be the A71 dimension of the YC_ID and the 6B dimension of the BLOCK.

At step 450, the processing unit 320 may detect at least one central event log corresponding simultaneously to the A71 dimension and the 6B dimension among the plurality of indexed event logs.

At step 460, the processing unit 320 may output information 1030 and 1040 related to at least one central event log. Information 1030 and 1040 related to the output central event log may include at least one of CASE_ID, NAME, TYPE, RESOURCE, BLOCK, and timestamp of each event log.

In addition, information may be obtained indicating the step associated with at least one central event log, which will be described below with reference to Figure 12 via button 1125. [ For example, the user can enter a number in the "# of follow event" field. The entered number may indicate a step associated with at least one central event log. The steps associated with at least one central event log are described in detail below with reference to FIG.

The technical contents described above with reference to Figs. 1 to 10 can be applied as they are, so that a more detailed description will be omitted below.

12 shows a flow diagram of a method for detecting a top event log and a sub event log of a central event log according to an example.

To analyze multiple event logs, the concept of a step associated with a central event log to retrieve an event log associated with a central event log may be used. The steps associated with the central event log may indicate how closely each of the plurality of event logs is associated with the central event log.

For example, an event log having a sequence in front of or behind an index sequence of a central event log in a particular dimension may be an event log having a stage associated with the central event log.

In another example, if there is a central event log having a tenth order in a certain dimension, the event log having the step 4 connected to the central event log may be the event log having the sixth order and the 14th order.

Indexed event logs for each of the one or more dimensions may each have steps associated with at least one central event log.

The event log having the order as compared to the central event log may be the parent event log, and the event log having the sequence that is later than the central event log may be the child event log.

Hereinafter, a method of detecting a central event log, a high-level event log, and a low-level event log and outputting a graph indicating a relationship between detected event logs will be described.

At step 1210, the processing unit 320 may obtain information indicating, for each of the one or more dimensions, the indexed event logs are associated with at least one central event log. The step may be the difference between the indexing sequences of the two event logs. For example, for a particular dimension, the fifth indexed event log and the seventh indexed event load may be linked in two steps.

According to one embodiment, the information indicating the stage associated with the central event log may be preconfigured.

According to another embodiment, the communication unit 310 may receive information from the user via the interface indicating the step of connecting with the central event log.

Step 1210 may be performed after step 430 described above is performed. For example, steps 1210 and 440 may be performed in parallel. As another example, the processing unit 320 may concurrently obtain information representing one or more of the plurality of dimensions and the step associated with the central event log. If one or more dimensions and information are acquired simultaneously, steps 1210 and 440 may be performed simultaneously.

At step 1220, the processing unit 320 may detect one or more upper event logs and sub event logs corresponding to the step represented by the acquired information among the indexed event logs for each of the one or more dimensions.

For example, if the acquired information is 3, the processing unit 320 may detect one or more upper event logs and lower event logs corresponding to three of the indexed event logs for each of the one or more dimensions . If there is no upper event log or lower event log corresponding to the step, the processing unit 320 may detect at least one upper event log and a lower event log existing in the step indicated by the information. A method of detecting the upper event and the lower event will be described in detail with reference to Figs. 13 to 15 below.

If step 1210 and step 440 are performed in parallel, step 1220 may be performed after step 450 is performed.

At step 1230, the processing unit 320 may output a graph in which at least one central event log is associated with one or more parent event logs and sub event logs.

For example, the output graph may be a graph wherein information associated with at least one central event log is associated with information relating to one or more ancestor event logs and information associated with the subent event logs.

The output graph may be a graph in which one or more upper event logs and sub event logs are divided into respective dimensions of one or more dimensions and associated with at least one central event log.

The output graph will be described with reference to Figs. 19 to 22 below.

Information related to the output event logs can be understood or described as an event log.

If step 1210 and step 440 are performed in parallel, step 1230 may be performed after step 460 is performed.

If there is a plurality of pieces of information related to at least one central event log in step 1240, the processing unit 320 determines that event It can be determined that a problem has occurred.

A method for determining that a problem has occurred will be described below with reference to FIG.

The technical contents described above with reference to Figs. 1 to 11 can be applied as they are, so that a more detailed description will be omitted below.

13 shows a flow diagram of a method for detecting an upper event log and a lower event log according to an example.

The above-described step 1220 may include the following steps 1310-1340.

According to one embodiment, each step of steps 1310-1340 may be represented by a code that may be executed in electronic device 300. [

In step 1310, the processing unit 320 may detect an index value of at least one central event log. For example, step 1310 may be performed for a particular dimension that includes at least one central event log. Index values can indicate the order in which event logs are indexed in a particular dimension.

In step 1320, the processing unit 320 may detect the upper event log and the lower event log from the lower level to detect the upper event log and the lower event log of the at least one central event log.

In step 1330, the processing unit 320 may detect a sub-event log having the next index value of the detected index value.

In step 1340, the processing unit 320 may detect an upper event log having a previous index value of the detected index value.

In step 1350, the processing unit 320 may increment the step.

After step 1350 is performed, step 1320 may be performed again. In step 1320, the processing unit 320 may determine whether the increased step is within the step indicated by the information. Steps 1330 through 1350 may be performed again if the increased step is within the step indicated by the information.

The above steps 1310 to 1350 may be repeatedly performed with each of the dimensions included in at least one central event log. The steps 1310 to 1340 may be repeatedly performed to thereby detect the upper event log and the lower event log in each of the dimensions.

The technical contents described above with reference to Figs. 1 to 12 can be applied as they are, so a detailed description will be omitted below.

14 shows a code for detecting a central event log, a parent event log, and a sub event log according to an example.

The code of FIG. 14 may be code for performing steps 1210 through 1220 described above, according to one embodiment.

"LISTMODEL" may be an array of dimensions that the central event log contains. The "listModel" can represent a specific dimension that the central event log contains. "listModel.key ()" may contain a list of values of the dimension. "listModel.Value" may be a value of a particular dimension. "#FOLLOWEVENT" may be information indicating a step.

"EVREF" may be a collection of at least one central event log ("evRef") simultaneously corresponding to one or more acquired dimensions. "TEMP" may be a set of temporary values ("temp"). "evRef.ID.idx ()" may be the index sequence in which the central event log is indexed. "evRef.NEXT" may be a sub event log of the central event log. "evRef.PREV" may be the parent event log of the central event log.

Code 1410 may be code that performs step 450 described above.

Code 1420 may be code that performs step 1320 described above.

The code 1430 may be code that performs step 1330 described above. That is, the code 1430 may be a code for detecting a sub event log of the central event log.

Code 1440 may be code that performs step 1340 described above. In other words, the code 1440 may be a code for detecting the upper event log of the central event log.

The technical contents described above with reference to FIGS. 1 to 13 can be applied as they are, so that a more detailed description will be omitted below.

FIG. 15 shows a code for detecting an upper event log and a lower event log according to an example.

The code of FIG. 15 may be code for performing the above-described steps 1210 to 1220, according to one embodiment.

Code 1510 may be code that performs step 1320 described above.

Code 1520 may be code that performs step 1330 described above. That is, the code 1520 may be a code for detecting a sub event log of the central event log.

"evNext.ID.Value ()" may be the value of the process instance assigned to the sub-event log. "evNext.ID.dimension ()" may be a dimension of the sub event log.

Code 1530 may be code that performs step 1340 described above. That is, the code 1530 may be a code for detecting the upper event log of the central event log.

"evPrev.ID.Value ()" may be the value of a pair of "pi.ID ()" and "ate.ID ()" in the parent event log. "evPrev.ID.dimension ()" can be the dimension of the parent event log.

The technical contents described above with reference to Figs. 1 to 14 may be applied as they are, so that a more detailed description will be omitted below.

FIG. 16 shows a code for generating a node of a central event log, a node of a parent event log, and a node of a child event log according to an example.

The code of FIG. 16 may be code for performing steps 450 and 1230 described above. For example, the code may be code for outputting the detected central event log, the parent event log, and the sub event log.

The node may refer to information associated with the event log being output. The edge may be a line or an arrow connecting the nodes together.

"NODES" may be a collection of information related to the event log. "EDGES" may be a set of edges.

"node.ID ()" may be a combination of "pi.ID ()" and "ate.ID ()". "node.PIName ()" may be the same as "pi.Name () ". "node.ATEName ()" may be the same as "ate.Name () ". "node.ATEType ()" may be the same as "ate.EventType ()". "node.Time ()" may be the same as "ate.TimeStamp ()". "node.DIMValue ()" may be the same as the dimension value. "node.Type ()" may be the type of the node. "node.Color ()" may be the color of the node. "node.Style ()" can represent the style of the node.

"edge.Source ()" may be a source node. "edge.Target ()" can be a target node. "edge.Type ()" can be either "pi.Name ()" or one of the dimension's values. "edge.TimeGap ()" may be the time difference between the time stamp of the source node and the timestamp of the target node. "edge.Color ()" can be the color of the edge.

Code 1610 may generate a node of at least one central event log.

Code 1620 may generate a node of the detected parent event log.

Code 1630 may generate a node of the detected sub-event log.

The technical contents described with reference to Figs. 1 to 15 can be applied as they are, so that a more detailed description will be omitted below.

FIG. 17 shows a code for connecting nodes of a central event log and nodes of a parent event log and nodes of a sub event log according to an example.

The code of FIG. 17 may be code for performing step 1230. FIG. For example, the code may be a code for connecting nodes of the generated central event log, nodes of the parent event log, and nodes of the sub event log.

Code 1710 may be code that links the node of the parent event log to the node of the central event log.

The code 1720 may be code that links the node of the sub event log to the node of the central event log.

The processing unit 320 may generate a graph in which one or more higher event logs and sub event logs are connected to each of the at least one central event log by executing the code of FIG.

The technical contents described above with reference to Figs. 1 to 16 can be applied as they are, so that a more detailed description will be omitted below.

Figure 18 shows a code for reconstructing the style of a node according to an example.

The code of FIG. 18 may be code for performing step 1230. FIG. For example, the processing unit 320 may change or reconfigure the style of the node by executing the code of FIG. The style of the node may be at least one of the color of the node and the type of the line of the node.

The code 1810 may be code that changes or reconfigures the style of the node.

The code 1820 may be code that causes the edge to display the time difference between the source node and the target node.

The processing unit 320 can generate a graph in which the style of the node is changed by executing the code of Fig.

The technical contents described above with reference to Figs. 1 to 17 can be applied as they are, so that a more detailed description will be omitted below.

FIG. 19 shows a graph of the relationship of the upper event logs and the lower event logs with each of the central event logs, when the step represented by the information according to an example is 1. FIG.

One or more higher event logs and sub event logs for at least one central event log of FIG. 11 described above are described with reference to FIGS. 19-22.

In the above-described step 1210, the processing unit 320 may obtain information indicating a step associated with at least one central event log 1030 and 1040. [ The step represented by the acquired information may be one.

In step 1220, the processing unit 320 may detect one or more higher event logs and sub-events corresponding to one of the indexed event logs for each of the one or more dimensions.

The central event log 1030 may include dimensions of CASE_ID, YC_ID, and BLOCK. Accordingly, the processing unit 320 can detect one or more upper events and sub events linked in one step with the central event log 1030 indexed in each of the dimensions of CASE_ID, YC_ID and BLOCK.

The processing unit 320 includes the same CASE_ID (PI-1281-1) as the central event log 1030 and the upper event log 1912 and the lower event log 1913 connected to the central event log 1030 in one step Can be detected.

The processing unit 320 can detect the upper event log 1922 and the lower event log 1924 that are connected to the central event log 1030 in one step and include the same YC_ID (A71) as the central event log 1030 .

The processing unit 320 may include the same BLOCK 6B as the central event log 1030 and may detect the upper event log 1902 and the lower event log 1903 connected to the central event log 1030 in one step .

The time difference displayed at each edge of the edges may be the time difference between the central event log 1030 and the parent event log or the sub event log. The time difference can be calculated using the time difference between the timestamps of the two event logs.

Similar to the central event log 1030, the processing unit 320 includes the same CASE_ID (PI-6790-1) as the central event log 1040, 1932) and the sub-event log 1954 can be detected.

The processing unit 320 may detect the upper event log 1932 and the lower event log 1934 which are associated with the central event log 1040 in one step and include the same YC_ID A71 as the central event log 1040 . The top event log 1932 can be concatenated in one step with the central event log 1040 simultaneously in the dimensions CASE_ID and YC_ID. In this case, only one upper event log 1932 can be output. The top event log 1932 may be the source node of two edges at the same time.

If the parent event log or the sub event log is a source node for two or more edges at the same time, the source node may be output differently from the other nodes.

The processing unit 320 may include the same BLOCK 6B as the central event log 1040 and may detect the upper event log 1952 and the lower event log 19422 linked to the central event log 1040 in one step .

At step 1230, the processing unit 320 may output a graph in which at least one central event log is associated with one or more parent event logs and sub event logs.

The processing unit 320 may output a graph connecting one or more upper event logs and lower event logs detected for each central event log when at least one central event log is a plurality.

The technical contents described above with reference to Figs. 1 to 18 can be applied as they are, so a detailed description will be omitted below.

FIG. 20 shows a graph of the relationship of the upper event logs and the lower event logs with each of the central event logs, when the step represented by the information according to an example is 2. FIG.

In the above-described step 1210, the processing unit 320 may obtain information indicating a step associated with at least one central event log 1030 and 1040. [ The step represented by the acquired information may be two.

In step 1220, the processing unit 320 may detect corresponding one or more higher event logs and sub-events within step 2 of the indexed event logs for each of the one or more dimensions. That is, the processing unit 320 can detect the upper event log and the lower event log that are connected in one step with the central event log 1030 or 1040 as each of the dimensions, and can also detect the central event log 1030 or 1040 ) And the upper-level event and the lower-level event log connected in two stages.

The technical contents described above with reference to Figs. 1 to 19 can be applied as they are, so that a more detailed description will be omitted below.

Figure 21 shows a graph of the relationship of the top event logs and the sub event logs with each of the central event logs when the step represented by the information according to an example is three.

In the above-described step 1210, the processing unit 320 may obtain information indicating a step associated with at least one central event log 1030 and 1040. [ The step represented by the acquired information may be three.

At step 1220, the processing unit 320 may detect corresponding one or more ancestor event logs and sub-events within three of the indexed event logs for each of the one or more dimensions. That is, the processing unit 320 may detect one or more upper event logs and sub event logs connected to the central event log 1030 or 1040, respectively, in steps 1, 2, and 3 in each of the dimensions.

The technical contents described above with reference to FIGS. 1 to 20 can be applied as they are, so that a more detailed description will be omitted below.

FIG. 22 shows a graph of the relationship of the upper event logs and the lower event logs with each of the central event logs, when the step represented by the information according to an example is 4. FIG.

In the above-described step 1210, the processing unit 320 may obtain information indicating a step associated with at least one central event log 1030 and 1040. [ The step represented by the acquired information may be four.

In step 1220, the processing unit 320 may detect the corresponding one or more higher event logs and sub-events within the four of the indexed event logs for each of the one or more dimensions. That is, the processing unit 320 may detect one or more upper event logs and sub event logs that are connected to the central event log 1030 or 1040, respectively, in the first, second, third, and fourth steps as the respective dimensions.

At step 1230, the processing unit 320 may output a graph in which at least one central event log is associated with one or more parent event logs and sub event logs.

If there is a plurality of at least one central event log, at least two of the plurality of central event logs may be connected to each other.

At step 1240, the processing unit 320 determines that a problem has occurred in the event involving the connection 2200 if at least two of the plurality of central event logs 1030 and 1040 are connected to each other It can be judged. The event associated with the connection 2200 may be a plurality of events.

In the example described with reference to FIGS. 19 through 22, the processing unit 320 may determine that a problem has occurred in the event associated with the connection 2200. The event involved in connection 2200 may be an event related to 6B of the dimension of the BLOCK. That is, the work between the two events for the two central event logs may be delayed due to problems associated with 6B.

The technical contents described above with reference to FIGS. 1 to 21 can be applied as they are, so that a more detailed description will be omitted below.

23 illustrates a flow diagram of a method for analyzing event logs in accordance with one embodiment.

In addition to the method of analyzing the event log described with reference to Figs. 4 to 22 described above, a method of analyzing the event log by analyzing the time difference between a plurality of event logs can be provided. A method for analyzing the event log by analyzing the time difference between a plurality of event logs will be described in detail below with reference to FIGS. 23 and 36. FIG.

The above-described step 410 may include the following step 2310. [

In step 2310, the processing unit 320 may analyze the time difference between the plurality of event logs based on the timestamp of each event log of the plurality of event logs.

According to one embodiment, the processing unit 320 may analyze only event logs that include at least one of the predetermined dimensions. Certain dimensions may be included in the plurality of dimensions.

For example, certain dimensions may be dimensions for a particular "NAME ". If the predetermined dimensions are dimensions for a particular "NAME ", the predetermined dimensions may be" DispatchLoadQuay "and" CompleteLoadQuay ".

According to another embodiment, the processing unit 320 may analyze the time difference between the event logs including the dimension of the same process instance ID among the plurality of dimensions, that is, the dimension of the same CASE_ID.

For example, when analyzing the time difference between event logs including the same CASE_ID dimension, the processing unit 320 analyzes the event logs including the same CASE_ID dimension according to the operation sequence in which the logistics is processed .

The processing unit 320 may generate the result of analyzing the time difference between the plurality of event logs as data.

The above-described step 420 may include the following step 2320. [

In step 2320, the processing unit 320 may index a plurality of event logs in each of the plurality of dimensions using the analyzed time difference. When the processing unit 320 indexes a plurality of event logs, it may use the result of analyzing the time difference described above. For example, when the processor 320 indexes event logs to a particular dimension, the event logs may index the analyzed time differences together if a time difference is analyzed for a particular dimension.

Step 2330 may correspond to step 430 described above. That is, the description of step 430 may be replaced by a description of step 2330. [

If additional events have been received, steps 2310 and 2320 may be performed again.

The above-described step 440 may include the following step 2340.

In step 2340, the processing unit 320 may obtain one or more of the plurality of dimensions.

According to one embodiment, when there is an event log that has elapsed a predetermined time set for a specific task among a plurality of event logs, based on the analyzed time difference, the processing unit 320 determines one or more dimensions . The predetermined time may be set differently based on the dimension.

For example, for the same process instance, if the predetermined time set between the operation of "DispatchLoadQuay" and the operation of "CompleteLoadQuay" is 15 minutes, the operation of "DispatchLoadQuay" among the event logs including the same CASE_ID and the operation of " If there are event logs in which the time difference between jobs exceeds 15 minutes, the processing unit 320 can obtain the dimension of " DispatchLoadQuay "and the dimension of" CompleteLoadQuay. &Quot;

According to another embodiment, the communication unit 310 may receive one or more dimensions from the user.

The acquired one or more dimensions may include a first dimension and a second dimension.

The above-described step 450 may include the following step 2350.

In step 2350, the processing unit 320 may detect a first event log including the first dimension and a second event log including the second dimension, respectively. The first event log and the second event log may each be plural.

For example, the first event log and the second event log may include the same CASE_ID dimension.

In step 2360, the processing unit 320 may output the time difference between the detected first event log and the second event log.

For example, the processing unit 320 may output the time difference between the first event log and the second event log through the communication unit 310 and the interface. The output time difference may be plural. If there are a plurality of output time differences, the processing unit 320 may arrange a plurality of time differences in a sequence in which the time differences are large. Each time difference of a plurality of time differences may be a time difference with respect to different process instances.

The above-described step 460 may include the following step 2370.

In step 2370, the processing unit 320 may output the first event log and the second event log as at least one central event log. That is, the processing unit 320 may output information related to the first event log and information related to the second event log.

According to one embodiment, the processing unit 320 may output a graph indicating a connected relationship between the first event log and the second event log when the output time difference exceeds a predetermined time.

The predetermined time may be set differently based on the first dimension and the second dimension.

The technical contents described above with reference to FIGS. 1 to 22 may be applied as they are, so that a more detailed description will be omitted below.

FIG. 24 shows a flowchart of a method of outputting a graph indicating a connection relationship between a first event log and a second event log according to an example.

The following step 2410 may be performed after step 2360 described above is performed.

In step 2410, the processing unit 320 may obtain information to select the output time difference.

According to one embodiment, the processing unit 320 may select the largest time difference among a plurality of time differences.

According to another embodiment, the communication unit 310 may receive information from the user via the interface to select a specific time difference among a plurality of time differences.

The above-described step 2370 may include the following step 2420. [

In step 2420, the processing unit 320 may output a graph indicating a connected relationship between the first event log and the second event log for the selected time difference.

The technical contents described above with reference to FIGS. 1 to 23 can be applied as they are, so that a more detailed description will be omitted below.

FIG. 25 shows a flowchart of a method of outputting a graph in which a first event log and a second event log according to an example are linked to respective upper event logs and a lower event log.

The following step 2510 may be performed after step 2370 described above is performed.

In step 2510, the processing unit 320 may obtain information indicating, for each of the one or more dimensions, the step of indexed event logs associated with the first event log and the second event log, respectively. The indexed event logs for each of the one or more dimensions may each have a step associated with the first event log or the second event log.

According to one embodiment, the information indicating the step connected to the first event log and the second event log, respectively, may be preset.

According to another embodiment, information may be received from the user via the communication unit 310 and the interface, which indicates a step connected to the first event log and the second event log, respectively.

Alternatively, step 2510 may be performed after step 2330 described above is performed. For example, steps 2510 and 2340 may be performed in parallel. As another example, the processing unit 320 may simultaneously acquire information indicating one or more dimensions of the plurality of dimensions and the steps associated with the first event log and the second event log, respectively. Steps 2510 and 2340 may be performed concurrently if more than one dimension and information are acquired at the same time.

At step 2520, the processing unit 320 may detect one or more higher event logs and lower event logs corresponding to the step indicated by the information among the indexed event logs for each of the one or more dimensions.

If steps 2510 and 2330 are performed in parallel, step 2520 may be performed after step 2350 is performed.

In step 2530, the processing unit 320 may output a graph in which the first event log and the second event log are associated with one or more higher event logs and sub event logs, respectively.

The output graph may be a graph in which one or more ancestor event logs and sub event logs are divided into respective dimensions of one or more dimensions and are associated with a first event log and a second event log, respectively.

If steps 2510 and 2330 are performed in parallel, step 2530 may be performed after step 2370 is performed.

In step 2540, if the first event log and the second event log are connected through one or more event logs and a part of the event logs of the sub event logs, It can be determined that a problem has occurred.

The technical contents described above with reference to FIG. 1 to FIG. 24 may be applied as they are, so a detailed description will be omitted below.

FIG. 26 shows the time difference between the first event log and the second event log according to an example.

In step 2340, the processing unit 320 may obtain one or more dimensions 2610 and 2620. [ The first dimension 2610 may be a dimension of "DispatchLoadQuay ". The second dimension 2620 may be a dimension of "Complete LoadQuay ".

In step 2350, the processing unit 320 may detect a first event log including a dimension of "DispatchLoadQuay " and a second event log including a dimension of" CompleteLoadQuay ".

In step 2360, if the first event log and the second event log include the same CASE_ID, the processing unit 320 may output the time difference between the first event log and the second event log. When outputting the time difference, the processing unit 320 may output one or more dimensions associated with the first event log or the second event log together with the time difference. The one or more dimensions to be output may be determined based on the dimension filter.

When there are a plurality of output time differences, the processing unit 320 may output the time differences in a sequence in which the time differences are large. For example, a time difference 2630 in which the dimension value of the CASE_ID is PI-6639-1 can be output at the top.

In step 2410, according to one embodiment, the communication unit 310 may receive information to select a time difference 2630 from the user.

According to another embodiment, the processing unit 320 may select the time difference 2630 output at the top.

The technical contents described with reference to FIG. 1 to FIG. 25 may be applied as they are, so that a more detailed description will be omitted below.

27 is a graph illustrating a connection relationship between a first event log and a second event log according to an example.

26, when the time difference 2630 is selected, the processing unit 320 determines whether the first event log 2710 and the second event log 2720 for the time difference 2630 and the second event log 2730 are connected to each other A graph indicating the relationship can be output. The first event logs 2710 and 2720 may be plural.

Because the first event logs 2710 and 2720 and the second event log 2730 may contain the same CASE_ID, they may be concatenated into a dimension of CASE_ID.

Since the time difference between the first event log 2710 and the second event log 2730 is 18 hours, 52 minutes and 42 seconds, the first event logs 2710 and 2720 and the second One or more higher events and sub event logs, each associated with an event log 2730, may be reviewed.

One or more higher event logs and lower event logs respectively associated with the first event logs 2710 and 2720 and the second event log 2730 of FIG. 27 described above will be described in detail below with reference to FIGS. 28 and 30 .

The technical contents described above with reference to FIGS. 1 to 26 may be applied as they are, so that a more detailed description will be omitted below.

FIG. 28 shows a graph of the relationship of the upper event logs and the lower event logs with each of the first event log and the second event log, when the step represented by the information according to an example is 1. FIG.

In the above-described step 2510, the processing unit 320 may obtain information indicating the steps associated with the first event logs 2710 and 2720 and the second event log 2730, respectively. The step represented by the acquired information may be one.

At step 2520, the processing unit 320 may detect one or more upper event logs and sub-events corresponding to one of the indexed event logs for each of the one or more dimensions.

In step 2530, the processing unit 320 may output a graph in which each of the first event logs 2710 and 2720 and the second event log 2730 are associated with one or more higher event logs and sub event logs .

The connection 2810 between the first event log 2720 and the second event log 2730 is described in detail below with reference to FIG.

The connection 2820 between the first event log 2710 and the first event log 2720 is described in detail below with reference to FIG.

The technical contents described above with reference to Figs. 1 to 27 can be applied as they are, so that a more detailed description will be omitted below.

FIG. 29 shows a graph of the relationship of the upper event logs and the lower event logs with each of the first event log and the second event log, when the step represented by the information according to an example is 2. FIG.

In the above-described step 2510, the processing unit 320 may obtain information indicating the steps associated with the first event logs 2710 and 2720 and the second event log 2730, respectively. The step represented by the acquired information may be four.

In step 2520, the processing unit 320 may detect one or more upper event logs and sub-events corresponding to steps 1, 2, 3 and 4 of the indexed event logs for each of the one or more dimensions have.

In step 2530, the processing unit 320 may output a graph in which each of the first event logs 2710 and 2720 and the second event log 2730 are associated with one or more higher event logs and sub event logs .

In the output graph, the first event log 2720 and the second event log 2730 can be connected to the event log for the same YT_ID dimension.

In step 2540, the processing unit 320 may determine that the delay between the first event log 2720 and the second event log 2730 is caused by the yard truck having a T = 208 dimension value of the YT_ID dimension.

The technical contents described above with reference to FIG. 1 to FIG. 28 can be applied as they are, so a detailed description will be omitted below.

FIG. 30 shows a graph of the relationship of the upper event logs and the lower event logs with each of the first event log and the second event log, when the step represented by the information according to an example is 3. FIG.

The step represented by the acquired information may be eight.

In the output graph, the first event log 2710 and the first event log 2720 can be connected to the event log for the same YT_ID dimension. An event log 3010 relating to a plugin may occur between the first event log 2710 and the first event log 2720. [

The processing unit 320 may determine that a delay between the first event log 2710 and the first event log 2720 is caused by an event related to the plug-in.

The technical contents described above with reference to FIGS. 1 to 29 can be applied as they are, so that a more detailed description will be omitted below.

FIG. 31 shows the time difference between the first event log and the second event log according to an example.

A scenario different from the scenario described above with reference to Figs. 26 and 30 will be described with reference to Figs. 31 and 32. Fig.

In step 2340, the processing unit 320 may obtain one or more dimensions 3110 and 3120. The first dimension 3110 may be a dimension of "CompleteDischargeQuay (complete) ". The second dimension 3120 may be a dimension of "CompleteDischargeYard (complete) ".

At step 2350, the processing unit 320 may detect a second event log comprising a dimension of "CompleteDischargeQuay (complete)" and a dimension of "CompleteDischargeYard (complete)".

In step 2360, if the first event log and the second event log include the same CASE_ID, the processing unit 320 may output the time difference between the first event log and the second event log.

In step 2410, the processing unit 320 may obtain information to select the output time difference 3130.

The technical contents described above with reference to FIG. 1 to FIG. 30 may be applied as they are, so that a more detailed description will be omitted below.

FIG. 32 shows a graph of the relationship of the upper event logs and the lower event logs with each of the first event log and the second event log, when the step represented by the information according to an example is 5;

31, when the time difference 3130 is selected, the processing unit 320 sets the connected relationship of the first event log 3210 and the second event log 3220 for the time difference 3130 to Can be displayed.

In the above-described step 2510, the processing unit 320 may obtain information indicating a step connected to the first event log 3210 and the second event log 3220, respectively. The step represented by the acquired information may be five.

In the output graph, the first event log 3210 and the second event log 3220 can be connected to the event log for the same WIDIGID dimension. It is detected that the key cran, which is the QC34, between the first event log 3210 and the second event log 3220 has performed an event 3230 for another process instance that is different from the process instance of the first event log 3210 .

The processing unit 320 can determine that the delay between the first event log 3210 and the second event log 3220 is caused by the key crane having QC34.

The technical contents described above with reference to Figs. 1 to 31 can be applied as they are, so that a more detailed description will be omitted below.

33 illustrates time differences between the first event log and the second event log according to an example.

Another scenario is described with reference to Figures 33-34.

In step 2340, the processing unit 320 may obtain one or more dimensions 3310 and 3320. [ The first dimension 3310 may be a dimension of " CompleteLoadYard (complete) ". The second dimension 3320 may be a dimension of "CompleteLoadQuay (complete) ".

In step 2350, the processing unit 320 may detect a second event log that includes a dimension of " CompleteLoadQuay (complete) " and a dimension of " CompleteLoadQuay (complete).

In step 2360, if the first event log and the second event log include the same CASE_ID, the processing unit 320 may output the time difference between the first event log and the second event log.

At step 2410, the processing unit 320 may obtain information to select the output time difference 3330.

The technical contents described above with reference to FIGS. 1 to 32 can be applied as they are, so that a more detailed description will be omitted below.

FIG. 34 shows a graph of the relationship of the upper event logs and the lower event logs with each of the first event log and the second event log, when the step represented by the information according to an example is 3. FIG.

33, when the time difference 3330 is selected, the processing unit 320 sets the connected relationship of the first event log 3410 and the second event log 3420 to the time difference 3330 as Can be displayed.

In the above-described step 2510, the processing unit 320 may obtain information indicating a step connected to the first event log 3410 and the second event log 3420, respectively. The step represented by the acquired information may be three.

In the output graph, the first event log 3410 and the second event log 3420 can be connected to the event log for the same YC_ID dimension. Between the first event log 3410 and the second event log 3420 it is detected that the yard crane B62 has performed an event 3430 for another process instance that is different from the process instance of the first event log 3410 .

The processing unit 320 can determine that the delay between the first event log 3410 and the second event log 3420 is caused by the yard crane having a delay of B62.

The technical contents described above with reference to Figs. 1 to 33 may be applied as they are, so that a more detailed description will be omitted below.

FIG. 35 illustrates a time difference between the first event log and the second event log according to an example.

Another scenario is described with reference to Figures 35-36.

In step 2340, the processing unit 320 may obtain one or more dimensions 3510 and 3520. The first dimension 3510 may be a dimension of "CompleteDischargeQuay ". The second dimension 3520 may be a dimension of "CompleteDischargeYard ".

In step 2350, the processing unit 320 may detect a second event log that includes a dimension of " CompleteDischargeQuay "and a dimension of" CompleteDischargeYard ".

In step 2360, if the first event log and the second event log include the same CASE_ID, the processing unit 320 may output the time difference between the first event log and the second event log.

In step 2410, the processing unit 320 may obtain information to select the output time difference 3530.

The technical contents described above with reference to Figs. 1 to 34 can be applied as they are, so that a more detailed description will be omitted below.

FIG. 36 shows a graph of the relationship of the upper event logs and the lower event logs with each of the first event log and the second event log, when the step represented by the information according to an example is 2. FIG.

35, when the time difference 3530 is selected, the processing unit 320 sets the connected relationship of the first event log 3610 and the second event log 3620 for the time difference 3530 to Can be displayed.

In the above-described step 2510, the processing unit 320 may obtain information indicating the step associated with the first event log 3610 and the second event log 3620, respectively. The step represented by the acquired information may be two.

In the output graph, it can be detected that the key cranes QC43 of the second event log 3420 and the RS13 yard cranes have performed other events 3630 and 3640.

The processing unit 320 can determine that the delay between the first event log 3410 and the second event log 3420 is caused by the key cranes QC43 and the RS13 yard cranes.

The technical contents described above with reference to Figs. 1 to 35 can be applied as they are, so that a more detailed description will be omitted below.

The apparatus described above may be implemented as a hardware component, a software component, and / or a combination of hardware components and software components. For example, the apparatus and components described in the embodiments may be implemented within a computer system, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable array (FPA) A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For ease of understanding, the processing apparatus may be described as being used singly, but those skilled in the art will recognize that the processing apparatus may have a plurality of processing elements and / As shown in FIG. For example, the processing unit may comprise a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as a parallel processor.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

  While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents, even if it is replaced or replaced.

300: electronic device
310:
320:
330:

Claims (23)

Performed by the event log analyzer,
Analyzing a plurality of event logs, each event log of the plurality of event logs comprising a record of each of a plurality of dimensions associated with an event of the event log;
Indexing the plurality of event logs into each of the plurality of dimensions based on the analysis;
Obtaining one or more dimensions of the plurality of dimensions that are expected to have a problem;
Detecting a plurality of central event logs corresponding to the acquired one or more of the plurality of indexed event logs;
Obtaining information indicative of a step associated with the plurality of central event logs, each event log indexed for each of the one or more dimensions having associated with the plurality of central event logs;
Detecting one or more higher event logs and lower event logs corresponding to each of the one or more dimensions in the step indicated by the information among the indexed event logs;
Outputting a graph in which the plurality of central event logs are associated with the one or more higher event logs and the lower event logs; And
If all or a part of the central event logs of the plurality of central event logs are connected to each other, determining that a problem has occurred in the event involved in the connection
Lt; / RTI >
The one or more dimensions that are expected to cause the problem are one or more of the dimensions associated with the event when the actual performance time of the event is longer than a predetermined time set for the time at which the event is performed,
Wherein the indexing step indexes the plurality of event logs into each of the plurality of dimensions based on a time stamp of each event log, and wherein indexing the plurality of event logs with the same dimension and the same timestamp And if the event logs exist, indexes the event logs based on a predetermined processing order set in the same dimension. delete The method according to claim 1,
Wherein the outputting step outputs the information related to the plurality of central event logs as a graph. The method according to claim 1,
Steps to receive additional event logs
Further comprising:
Wherein analyzing the plurality of event logs adds the received additional event logs to the plurality of event logs and analyzes the plurality of event logs to which the additional event logs have been added. The method according to claim 1,
Wherein the analyzing step analyzes the plurality of event logs by extracting a record of each of the dimensions associated with the event of each event log. delete delete The method according to claim 1,
Wherein the indexing indexes the plurality of event logs into each of the plurality of dimensions using a hash data structure. delete The method according to claim 1,
Wherein the graph is associated with the plurality of central event logs, wherein the one or more higher event logs and the lower event logs are divided into respective dimensions of the one or more dimensions. delete The method according to claim 1,
Wherein analyzing the plurality of event logs comprises analyzing a time difference between the plurality of event logs based on a time stamp of each event log,
Wherein the indexing indexes the plurality of event logs using the analyzed time difference. 13. The method of claim 12,
Wherein analyzing the plurality of event logs comprises analyzing only event logs comprising at least one of the predetermined dimensions,
Wherein the predetermined dimensions are included in the plurality of dimensions. 13. The method of claim 12,
Wherein analyzing the plurality of event logs analyzes the time difference between event logs comprising a dimension of the same process instance identification among the plurality of dimensions. 13. The method of claim 12,
Outputting a time difference between the first event log and the second event log
Further comprising:
The received one or more dimensions are a first dimension and a second dimension,
Wherein the detecting includes detecting a first event log including the first dimension and a second event log including the second dimension,
Wherein the outputting of the information outputs the first event log and the second event log as the plurality of central event logs. 16. The method of claim 15,
The outputting of the time difference may include outputting the plurality of time differences in a sequence of a plurality of time differences in a case where the first event log and the second event log are respectively plural, Way. 16. The method of claim 15,
Wherein the step of outputting the information comprises outputting a graph indicating a connected relationship between the first event log and the second event log when the time difference exceeds a predetermined time. 18. The method of claim 17,
Wherein the predetermined time is set differently based on the first dimension and the second dimension. 16. The method of claim 15,
Obtaining and outputting information for selecting the output time difference
Further comprising:
Wherein the step of outputting the information comprises outputting a graph indicating a relationship between the first event log and the second event log for the selected time difference. 16. The method of claim 15,
The method comprising the steps of: acquiring information indicative of a step associated with each of the first event log and the second event log, wherein event logs indexed for each of the one or more dimensions are associated with the first event log or the second event log Respectively; And
Detecting at least one upper event logs and lower event logs corresponding to the information indicated by the information among the indexed event logs for each of the one or more dimensions
Further comprising:
Wherein outputting the information comprises outputting a graph wherein the first event log and the second event log are associated with the one or more parent event logs and the sub event logs, respectively. 21. The method of claim 20,
When the first event log and the second event log are connected through an event log of at least one of the one or more upper event logs and the lower event logs, determining that a problem has occurred in the event involved in the partial event log
Further comprising the steps of: A computer-readable recording medium containing a program for carrying out the method according to any one of claims 1, 3 to 5, 8, 10, 12 to 21. Analyzing a plurality of event logs, each event log of the plurality of event logs comprising a record of each of a plurality of dimensions associated with an event of the event log; Indexes the plurality of event logs into each of the plurality of dimensions based on the plurality of dimensions, obtains one or more dimensions that are expected to have a problem among the plurality of dimensions, The method comprising: detecting a plurality of central event logs corresponding to one or more dimensions, and obtaining information indicative of a step associated with the plurality of central event logs, wherein event logs indexed for each of the one or more dimensions Each associated with event logs, each of the one or more dimensions Detecting one or more higher event logs and lower event logs corresponding to the information indicated by the information among the indexed event logs for the plurality of event logs and the plurality of event logs associated with the one or more higher event logs and the lower event logs Outputting a graph and determining that a problem has occurred in an event related to the connection when all or a part of the central event logs of the plurality of central event logs are connected to each other,
Lt; / RTI >
The one or more dimensions that are expected to cause the problem are one or more of the dimensions associated with the event when the actual performance time of the event is longer than a predetermined time set for the time at which the event is performed,
Wherein the processor indexes the plurality of event logs into each of the plurality of dimensions based on a time stamp of each event log, and generates an event log having the same dimension and the same timestamp among the plurality of event logs And indexes the event logs based on a predetermined processing order set in the same dimension, if they exist.

Images