KR102088285B1 - Method and device for collecting log based on rule - Google Patents

Abstract

The present invention relates to a rule-based dynamic log collection method and apparatus capable of increasing the quality of collected log data while controlling the amount of logs dynamically collected according to the quality of logs generated for each service or application. The method and the apparatus set one or more log collection rules consisting of conditions defined based on log characteristic information and one or more actions related to log collection executed when the conditions are matched, and logs generated for each service or application When data is received, log characteristic information of the received log data is compared with each condition defined in the set one or more log collection rules to check matching log collection rules, and if matching log collection rules exist, the corresponding Depending on one or more actions defined in the log collection rules It is arranged to process the group the received log data.

Description

Method and device for collecting log based on rule}

The present invention relates to a rule-based dynamic log collection method and apparatus capable of increasing the quality of the collected log data while controlling the amount of logs dynamically collected according to the quality of logs generated for each service or application.

Log is a record for tracking problems occurring during the development or operation of a program or monitoring the operation status. Logging is considered essential for failure management and efficient operation in a large-scale distributed system such as a cloud system.

However, as the number of services or applications running in the cloud system increases, the amount of logs generated increases significantly, and if proper control is not achieved, the amount of logs becomes too large, resulting in insufficient log storage or network bandwidth within the cluster even with log data alone. It also takes a considerable amount of money and adversely affects service quality.

For example, when a service is composed of a small unit of container-based application, processing by an external request is processed by interlocking several or dozens of applications. In this case, it is possible to draw meaningful conclusions by tracing the operational status of the service or analyzing the logs of multiple applications at the same time for failure analysis.

As shown in FIG. 1, a cloud system is usually installed on a plurality of nodes 10, such as a distributed server, so that hundreds or thousands of applications 110 are continuously executed, and distributed environments in which applications work in cooperation with each other. In order to extract meaningful conclusions through log analysis, log data generated from a plurality of applications 110 are recorded in a specific central database (hereinafter referred to as log database 20).

Therefore, in order to transmit and store logs generated from hundreds or thousands of applications 110 in the plurality of nodes 10 to the central log database 20, a considerable amount of internal communication resources and storage resources of the cloud system are consumed. Is done.

In particular, in a recent cloud environment, services are being developed in a form of micro-service architecture (MSA) rather than a traditional 3-tier structure. Under the assumption that the same function is provided, the log amount becomes larger as the number of instances for the MSA application is on average higher than the number of instances for the 3-tier application. As such, as the amount of logs increases, control of the amount of logs to be collected becomes important.

So far, for controlling the amount of logs, two approaches have been taken so far.

The first is to collect all logs in the development stage, but limit the log function in the operation stage, so that the application generates less log information in the actual operation environment. That is, as illustrated in FIG. 2, each application 110 generates logs and stores them in the local database 120 provided in the node 10, and periodically stores log data stored in the local database 120. In collecting and transmitting to the central log database 20, the application source controls the application source so that a specific part generates a log and a specific part does not generate a log. Since this is a method of controlling the log itself generated by the application 110, it is possible to solve the problem that the log affects the quality of service or excessively increases the amount of logs. On the other hand, the first method requires a process of selecting which logs are collected for each application 110 and which logs should not be collected, and the selective log generation function needs to be reflected in the service logic. Depending on the situation, it is difficult to dynamically change the log amount.

The second is a log sampling method, as shown in Figure 3, the application 110 to generate all the logs, but further provided with a log collector 130, the log collector 130 to selectively log This is a method of selecting and storing in the local database 120. This can control the amount of logs regardless of the service logic, and is more efficient than the method of controlling the application 110. However, this method also has a problem of manually adjusting the sampling rate for each service, and since the log is sorted by a simple statistical method, an important log may be missed. For example, if only 1 log is sent every 10 logs, it is highly likely to be discarded if an important log occurs on the 15th. In particular, since the sampling rate is manually adjusted for each service, the log amount is adjusted depending on the situation. Difficult to change dynamically.

Registered Korean Registered Patent No. 10-1671314, October 26, 2016 (Name: Travel product search log data analysis system)

The present invention is to provide a rule-based dynamic log collection method and apparatus capable of increasing the quality of the collected log data while controlling the amount of logs dynamically collected according to the quality of logs generated for each service or application.

The present invention is a solution for solving the above-described problems, comprising: setting one or more log collection rules consisting of conditions defined based on log feature information and one or more actions related to log collection executed when the conditions are matched; Receiving log data generated for each service or application; Comparing the log characteristic information of the received log data with each condition defined in the set one or more log collection rules to check matching log collection rules; And if there is a matching log collection rule, processing the received log data according to one or more actions defined in the log collection rule.

In the rule-based dynamic log collection method, the log feature information may include one or more of a log level, a log creator, a log generation time, and a log generation location.

In addition, in the rule-based dynamic log collection method, processing the log data may include: directly storing the received log data regardless of a sampling rate; Storing or deleting the received log data according to a currently set sampling rate; And increasing or decreasing the currently set sampling rate.

Further, in the rule-based dynamic log collection method, the conditions of the log collection rule may include one or more of whether log data having specific log characteristic information is generated, and the number of times the log data is generated.

In addition, the rule-based dynamic log collection method may further include storing or deleting received log data according to a currently set sampling rate if no matching log collection rule exists.

In addition, the rule-based dynamic log collection method, prior to the receiving step, setting reference information including at least one of a default value, an upper limit, and a lower limit for a sampling rate indicating the frequency of collecting log data. Further comprising, in the step of processing the log data, it is possible to process the log data within a range defined by the reference information.

In addition, the present invention, as a solution to the above-described problem, stores a condition defined based on log feature information and one or more log collection rules consisting of one or more actions related to log collection executed when the conditions are matched, and A rule interpreter that compares log characteristic information of log data generated for each service or application with one or more preset log collection rules, and checks a log collection rule matching the currently received log data; A sampling adjuster for adjusting a preset sampling rate according to the log collection rule found to be matched in the rule interpreter; And a log processor that stores or deletes log data currently received according to a log collection rule determined to be matched by the rule interpreter or a currently set sampling rate.

The rule-based dynamic log collection device may further include a log analyzer that receives log data generated for each service or application and formats it in a predetermined format.

The present invention is applied to a log analysis system that analyzes a log generated during the execution of a service or application, in particular, applied to a node on which a service or application to be analyzed is executed, in collecting log data generated in the service or application, Set one or more log collection rules for each service or application, which consist of conditions based on log feature information and actions to control log collection performed when the conditions are met, and corresponding applications or each application in the service By monitoring the log data generated in the log, when the conditions of the log collection rule are matched, by performing the set action in response to the conditions, collecting the log data according to the sampling rate, and changing the sampling rate according to the log generation situation. Number Which can change the amount of the log data dynamically.

Through this, the present invention can flexibly adjust the log amount according to the log generation situation, and in particular, collects log data of high interest by the operator at a higher frequency and decreases the collection frequency for the logs that are not. At the same time as controlling, the quality of the collected log data can be improved.

In addition, the present invention can be applied without significant changes to the existing log system by applying to the processing flow of the log agent already installed in the node.

1 is a block diagram showing the basic structure of a log collection system.
2 is a view for explaining a conventional log collection method.
3 is a view for explaining another conventional log collection method.
4 is a block diagram showing a rule-based dynamic log collection device according to the present invention.
5 is a flowchart illustrating a rule-based dynamic log collection method according to the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, in the following description and accompanying drawings, detailed descriptions of well-known functions or configurations that may obscure the subject matter of the present invention are omitted. In addition, it should be noted that the same components throughout the drawings are indicated by the same reference numerals as much as possible.

The terms or words used in the present specification and claims described below should not be construed as being limited to the ordinary or dictionary meanings, and the inventors are appropriate as concepts of terms for explaining their own invention in the best way. It should be interpreted as meanings and concepts in accordance with the technical spirit of the present invention based on the principle that it can be defined. Therefore, the embodiments shown in the embodiments and the drawings described in this specification are only the most preferred embodiments of the present invention, and do not represent all of the technical spirit of the present invention. It should be understood that there may be water and variations.

In addition, terms including ordinal numbers such as first and second are used to describe various components, and are used only to distinguish one component from other components, and to limit the components It is not used. For example, without departing from the scope of the present invention, the second component may be referred to as the first component, and similarly, the first component may also be referred to as the second component.

In addition, when referring to a component being "connected" or "connected" to another component, it means that it can be connected or connected logically or physically. In other words, it may be understood that a component may be directly connected to or connected to other components, but other components may exist in the middle and may be connected or connected indirectly.

In addition, the terms used herein are only used to describe specific embodiments, and are not intended to limit the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In addition, the terms "comprises" or "having" described herein are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, and one or the same. It is to be understood that the present invention does not exclude in advance the possibility of the presence or the addition of other features, numbers, steps, operations, components, parts, or a combination thereof.

The rule-based dynamic log collection apparatus and method according to the present invention is applied to each node 10 executing one or more applications or services in a distributed-based service system as shown in FIG. 1 and operated in the node 10 To monitor the log generated from one or more applications 110, it is to collect the appropriate amount of log data. Particularly, the present invention is applicable to the log sampling method as shown in FIG. 3, and after the application 110 generates all logs, the logs generated by the application 110 are selectively collected and stored in the local DB 120. Is to do.

The configuration and operation of the rule-based dynamic log collection apparatus and method according to the present invention will be described with reference to FIGS. 3 and 4.

3 is a block diagram showing the configuration of a rule-based dynamic log collection device according to an embodiment of the present invention.

Referring to FIG. 3, the rule-based dynamic log collection device 400 according to the present invention sets the log collection rule 410 for each application or service operated in the node 10, and the log collection rule 410 ) Selectively collects logs generated from a plurality of applications 110 and stores them in the local DB 360 installed on the node 10, but dynamically adjusts the amount of logs stored.

For reference, the log data generated by the application 110 may be divided into a plurality of levels according to its nature. For an example of an application implemented in Java, the log level consists of six layers: FATAL, ERROR, WARN, INFO, DEBUG, and TRACE. Here, FATAL indicates a log related to a fatal error that may cause the program to stop, ERROR indicates a log for an error that is not enough to stop the program, WARN indicates log data of a potentially dangerous situation, and INFO indicates the program. It represents log data that simply reports the progress, DEBUG represents log data with information necessary for debugging a program, and TRACE represents log data with more detailed information than DEBUG.

The rule-based dynamic log collection device 400 according to the present invention defines one or more log collection rules 410 for each application or service in consideration of the log occurrence situation in consideration of these log levels, and is generated by the application 110 By monitoring the logged logs, the log collection amount is dynamically adjusted by applying the log collection rule 410 according to the current log occurrence situation. For example, log data at the ERROR and WARN levels, which are essential for the developer or operator, are collected without omission, while log data at the INFO level that occurs during normal operation is collected as little as possible. You can.

To this end, in the present invention, the log level may be divided into the six layers described above, and more simply, the INFO, WARNING, and ERROR three layers.

Referring to FIG. 4 again, the rule-based dynamic log collection device 400 according to the present invention includes a log analyzer 420, a rule interpreter 430, and a sampling adjuster 440 for performing the above-described functions. And, it may be configured to include a log processor 450.

All log data generated by the application 110 of the node 10 is received by the log analyzer 420.

The log analyzer 420 receives and formalizes log data generated from one or more applications 110. Specifically, the normal log data includes one or more of a log creator (service or application name), a log creation date, a log level (eg, INFO, WARN, ERROR), a log generation location, and log contents. However, since a certain form or format is not determined, the log data format may be different for each application or service. Therefore, the log analyzer 420 receives log data generated from one or more applications 110 and formalizes it in a predetermined format.

The log data normalized in the log analyzer 420 is input to the rule interpreter 430. The rule interpreter 430 compares the input log data with a preset log collection rule 410 to check a log collection rule matching the current log generation situation.

The log collection rule 410 is defined as {condition, behavior} so that the amount of log collection can be dynamically adjusted according to the log generation situation. The “condition” is a condition to which the corresponding rule is applied, and may include one or more log characteristic information (eg, log creator, log level, log occurrence location, etc.). In addition, the "action" is an action related to log collection, specifically, an action for determining the frequency of storing or collecting logs.

That is, the rule interpreter 430 compares log characteristic information of the standardized log data with the log collection rule defined as described above, and checks a log collection rule matching the currently received log data.

The rule interpreter 430 transmits a log collection rule matching the currently generated log data to the sampling coordinator 440 and the log processor 450, and the log in which the sampling coordinator 440 and the log processor 450 match Perform the actions defined in the collection rules.

Specifically, the log processor 450 processes the received log data according to the action set in the matching log collection rule confirmed by the rule interpreter 430. Here, the processing of the log data includes an act of saving directly to the local DB 460, discarding it without saving immediately, or selectively storing it according to a set sampling rate.

Then, the sampling adjuster 440 changes the sampling rate set in the log processor 450 according to the action set in the matching log collection rule checked by the rule interpreter 430.

That is, the rule-based dynamic log collection device 400 according to the present invention, according to the log collection rule, immediately saves the log data generated by the application 110, immediately discards it without storage, or selects it according to the set sampling rate While saving, the set sampling rate can be automatically changed, and as a result, the log collection amount can be dynamically adjusted according to the log generation situation.

Hereinafter, a dynamic log collection operation according to the rule-based dynamic log collection device 400 according to the present invention will be described as an example.

In the present invention, the log collection rule 410, which is defined as a condition and an action, may be more specifically set based on a log level among log feature information. In this case, if N logs of log level A persist, , Logs can be saved / deleted, and the sampling rate is increased or decreased by P%. "

The following is an example of log collection rules set in the above-described format for a specific application. For reference, one or more of the following log collection rules may be set for each application or service.

Rule1 = {INFO≥1000, 0, -1}: If 1000 logs of INFO level occur continuously, the sampling rate is reduced by 1%.

Rule2 = {WARNING, 1, +1}: When a log of WARNING level occurs once, the log is collected and the sampling rate is increased by 1%.

Rule3 = {ERROR, 1, +5}: If a log of ERROR level appears once, collect the log and increase the sampling rate by 5%.

In the above example, the log collection rule consists of {conditions, whether to store, and sampling adjustment values}. Here, the storage and sampling adjustment values are action information for determining storage and sampling rates. Particularly, if the storage status is 0, it is stored according to the set sampling rate, and when the storage status is 1, it means saving regardless of the sampling rate.

According to this, when the log data of the ERROR level is received from the specific application 110, the rule interpreter 430 extracts rule 3 as a matching log collection rule and delivers it to the sampling coordinator 440 and the log processor 450 Thus, the sampling adjuster 440 increases the sampling rate set in the log processor 450 to 5%, and the log processor 450 stores the received ERROR level log data in the local DB 460.

Conversely, when 1000 logs of the INFO level are continuously generated from the specific application 110, the rule interpreter 430 extracts the rule 1 and delivers it to the sampling adjuster 440, and sends the log data to the log processor 450. To deliver. Accordingly, the sampling adjuster 440 decreases the sampling rate set in the log processor 450 by 1%, and the log processor 450 selects log data of the INFO level received at a reduced sampling rate of 1% and selects the local DB. 460.

According to the above rule, when only the INFO level log data is continuously generated in the corresponding application 110, the sampling rate is gradually decreased, and the amount of log data collected by the log collection device 400 according to the present invention is gradually increased. When the log data of WARNING or ERROR level is reduced, the amount of log data collected by the log collecting device 400 increases as the sampling rate increases.

Typically, log data generated when an application or service is normally operated is for simple reporting, and is unnecessary data for the operator or developer. Therefore, it is only necessary to confirm that it is in a normal state. On the other hand, in the case of a failure, it is highly likely that log information showing that the quality of service is not as good as normal, even if it is log data at the INFO level. Therefore, it is desirable to collect the log data of the WARING or ERROR level at the same time, and when the log of the WARING or ERROR level occurs, it is preferable to increase the frequency of collecting the log data of the INFO level a little more, and the present invention provides dynamic Significant log data can be collected.

In addition, the rule-based dynamic log collection device 400 according to the present invention, in collecting log data based on a log collection rule, for convenience of operation, one or more of a default value, an upper limit, and a lower limit for the sampling rate By setting, the dynamic variation of the sampling rate can be made within a certain range.

Next, FIG. 5 is a flowchart illustrating a rule-based dynamic log collection method according to the present invention.

The rule-based dynamic log collection method, which is executed through the log collection device 400 according to the present invention, will be described according to an operation sequence.

First, the present invention sets one or more log collection rules 410 for each application or service for rule-based dynamic log collection (S105). The log collection rule 410 is defined as a condition that defines a criterion to apply a rule based on one or more log feature information and an action related to log collection applied when the conditions are matched. The above action means an action of determining the storage and sampling rate of log data.

In addition, according to the present invention, one or more of a default value, an upper limit value, and a lower limit value are set as reference information of a dynamically changing sampling rate (S110).

In this state, when one or more applications 110 are executed in the corresponding node 10 and log data is generated, log data generated in the one or more applications 110 is received in real time through the log analyzer 420. (S115). At this time, the log analyzer 420 may format the received log data in a predetermined format to facilitate comparison of log feature information.

When the log data is received, the rule-based dynamic log collection device 400 according to the present invention analyzes the log data received through the rule interpreter 430 and matches the log collection rule matched among the preset one or more log collection rules 410 It is checked whether it exists (S120). This may be achieved by comparing log feature information included in log data with respective conditions defined in the one or more log collection rules 410. In addition, for the comparison, the rule interpreter 430 may further perform statistical processing such as counting based on log feature information.

As a result of the check in step S120, if there is a log collection rule to be applied, through the sampling adjuster 440 and / or the log processor 450, the set sampling rate is changed or the received log data is stored or deleted (( S125).

On the other hand, as a result of checking in step S120, if there is no log collection rule to be applied, the received log data is stored or deleted according to the currently set sampling rate through the log processor 450 (S130).

Steps S115 to S130 described above are repeatedly executed each time log data is received until the log collection function ends (S135).

As described above, the rule-based dynamic log collection device 400 according to the present invention can collect log data while dynamically changing the sampling rate according to the log generation situation.

The rule-based dynamic log collection method according to the present invention described above may be implemented in a form of software readable through various computer means and recorded in a computer-readable recording medium. Here, the recording medium may include program instructions, data files, data structures, or the like alone or in combination. The program instructions recorded on the recording medium may be specially designed and configured for the present invention or may be known and usable by those skilled in computer software. For example, the recording medium includes magnetic media such as hard disks, floppy disks, and magnetic tapes (Magnetic Media), compact disk read only memory (CD-ROM), optical media such as DVD (Digital Video Disk), and optical media. Includes magneto-optical media, such as a floppy disk, and hardware devices specifically configured to store and execute program instructions, such as ROM, random access memory (RAM), flash memory, etc. do. Examples of program instructions may include high-level language code that can be executed by a computer using an interpreter, as well as machine code such as produced by a compiler. Such a hardware device can be configured to operate as one or more software modules to perform the operation of the present invention, and vice versa.

In addition, although the present specification and the drawings have been described with respect to preferred embodiments of the present invention, it is common in the technical field to which the present invention pertains that other modified examples based on the technical spirit of the present invention can be implemented in the exceptions of the embodiments disclosed herein. It is obvious to those who have knowledge. In addition, although specific terms are used in the present specification and drawings, they are merely used in a general sense to easily describe the technical contents of the present invention and to help understand the present invention, and are not intended to limit the scope of the present invention.

Likewise, although the operations are depicted in the drawings in a particular order, it should not be understood that such operations should be performed in the particular order shown or in sequential order, or that all shown actions should be performed in order to obtain desirable results. In certain cases, multitasking and parallel processing may be advantageous. In addition, separation of various system components of the above-described embodiments should not be understood as requiring such separation in all embodiments, and the described program components and systems are generally integrated together as a single software product or packaged in multiple software products. It should be understood that it can be.

The rule-based dynamic log collection apparatus and method according to the present invention can be applied to a log analysis system that analyzes a log generated during execution of a service or application, and in particular, on a node on which a service or application to be analyzed is executed. Applied, it is possible to collect log data generated by the service or application.

In particular, according to the present invention, in collecting log data for each service or application, a log collection rule consisting of a condition based on log characteristic information and an action capable of controlling log collection performed when the conditions are matched is a service or application. By setting one or more per each, monitoring the log data generated in the application or the respective applications in the service, and when the conditions of the log collection rule are matched, perform the set action in response to the condition, according to the sampling rate While collecting log data, the amount of log data collected can be dynamically changed by changing the sampling rate to match the log generation situation.

Through this, the present invention can flexibly adjust the log amount according to the log generation situation, and in particular, the operator collects log data having high interest at a higher frequency and reduces the collection frequency for the logs that are not. At the same time as controlling, the quality of the collected log data can be improved.

In addition, the present invention can be applied without significant changes to the existing log system by applying to the processing flow of the log agent already installed in the node.

400: rule-based dynamic log collection device
410: log collection rules
420: log analyzer
430: rule interpreter
440: sampling regulator
450: Log handler

Claims (12)

Setting one or more log collection rules for each service or application, which are defined based on log feature information, and one or more actions related to log collection executed when the conditions are matched;
Receiving log data generated for each service or application;
Comparing the log feature information including the log level of the received log data with each condition defined in the set one or more log collection rules to check matching log collection rules; And
If a matching log collection rule exists, a rule-based dynamic log collection method comprising dynamically adjusting a log collection amount according to the log collection rule to process the received log data. According to claim 1,
The log feature information includes a log level, a log creator, a log creation time, and one or more of a log generation location. According to claim 1, The step of processing the log data,
Directly storing the received log data regardless of a sampling rate;
Storing or deleting the received log data according to a currently set sampling rate; And
A rule-based dynamic log collection method comprising at least one of the steps of increasing or decreasing the currently set sampling rate. According to claim 1,
The conditions of the log collection rule, the rule-based dynamic log collection method characterized in that it includes at least one of the occurrence of log data having specific log feature information, and the number of occurrences of the log data. According to claim 1,
If there is no matching log collection rule, the rule-based dynamic log collection method further comprising the step of storing or deleting the received log data according to the currently set sampling rate. According to claim 1,
Before the step of receiving, further comprising setting reference information including one or more of a default value, an upper limit, and a lower limit for the sampling rate indicating the frequency of collecting log data,
The step of processing the log data is a rule-based dynamic log collection method characterized in that the log data is processed within a range defined by the reference information. Conditions defined based on log characteristic information and one or more log collection rules consisting of one or more actions related to log collection executed when the conditions are matched are set and stored for each service or application, and generated for each service or application A rule interpreter that compares log characteristic information including a log level of log data with one or more preset log collection rules, and checks a log collection rule matching the currently received log data;
A sampling adjuster that dynamically adjusts a log collection amount by adjusting a preset sampling rate according to a log collection rule found to be matched by the rule interpreter; And
A rule-based dynamic log collection device including a log collection rule determined to match in the rule interpreter or a log processor that stores or deletes currently received log data according to a currently set sampling rate. The method of claim 7,
The rule-based dynamic log collection device further comprises a log analyzer that receives the log data generated for each service or application and formats the data into a predetermined format. The method of claim 7,
The log feature information includes a log level, a log creator, a log creation time, and one or more of a log generation location. The method of claim 7,
The log collection rule action is one of immediately storing received log data regardless of a sampling rate, storing or deleting received log data according to a currently set sampling rate, or increasing or decreasing a currently set sampling rate. A rule-based dynamic log collection device comprising the above. The method of claim 7,
The conditions of the log collection rule, the rule-based dynamic log collection device, characterized in that it includes at least one of the occurrence of log data having specific log feature information, and the number of occurrences of the log data. The method of claim 7, wherein the log processor
If there is no matching log collection rule, the rule-based dynamic log collection device characterized in that the received log data is stored or deleted according to the currently set sampling rate.

Images