KR102519006B1 - Log data management method and server for improving search speed of log data based on digital - Google Patents

Abstract

A log data management method and server for improving the viewing speed of digital-based log data are disclosed. According to one embodiment of the present invention, the log data management method includes the steps of: receiving a plurality of types of log data; accumulating the plurality of types of log data in the reverse chronological order; processing the plurality of types of log data according to preset standards; and storing the plurality of types of processed log data in the reverse chronological order in a database.

Description

Log data management method and server for improving search speed of digital-based log data

The present disclosure relates to a log data management method and server for improving the speed of inquiry of digital log data.

Devices providing content services continuously generate log data related to providing content services, and analyzing the large amount of log data generated in this way may be an important factor in providing higher quality content services. The aforementioned log data may be continuously generated over time.

For example, device problems can be identified through log data analysis, and user behavior or UX (user experience) improvements to improve content services can be identified.

Accordingly, operators have sought ways to improve log data inquiry speed by more efficiently storing and managing log data collected from user terminals.

Republic of Korea Patent Publication No. 10-2012-0085375 (2012. 08. 01.)

The purpose of the embodiments disclosed in the present disclosure is to provide a log data management method and server for improving the search speed of digital-based log data to improve the search speed of log data through a query by efficiently storing and managing log data. there is.

The problems to be solved by the present disclosure are not limited to the problems mentioned above, and other problems not mentioned will be clearly understood by those skilled in the art from the description below.

A log data management method according to an aspect of the present disclosure for achieving the above technical problem is performed by a log data management server, comprising: receiving a plurality of log data; accumulating the plurality of log data in reverse chronological order; processing the plurality of log data according to predetermined criteria; and storing the processed plurality of log data in a database in reverse chronological order.

In the accumulating step, when a preset accumulation time arrives or a preset number of log data is accumulated, the processing step includes grouping the accumulated plurality of log data into a preset first unit to at least one log data. Generating the above first log data group; may include.

The log data management method further includes generating a second log data group by grouping the at least one or more first log data groups into a second unit, wherein the second unit takes a longer time than the first unit. Or it may be a criterion that includes a large number.

The method for managing log data may further include, prior to the processing, generating a separation criterion for classifying the plurality of log data, wherein the processing of the log data includes the accumulation of the plurality of logs. and processing the data in the form of partition data in which the log levels are matched by classifying the data according to the separation criterion, and in the saving step, the plurality of log data matched with the log levels are stored in reverse order of time. can

The log data management method further includes, after the step of storing the plurality of log data matched with the log level in reverse chronological order, the log data management server transmitting the log level to a service server and sharing the log data. can include

In the log data management method, in the generating of the separation criterion, the separation criterion is generated to classify the log data based on the change in traffic over time, or the separation criterion is generated to classify the log data based on the time of the log data. can do.

In addition, the log data management server according to another aspect of the present disclosure includes a loader unit; reverse order processing unit; and a processor for controlling the operation of the data processing unit, wherein the processor receives a plurality of log data, accumulates the plurality of log data in reverse order of time, and stores the plurality of log data according to a predetermined criterion. It is possible to process and store the processed plurality of log data in reverse chronological order in the database.

During the accumulation, when a preset accumulation time arrives or a preset number of log data is accumulated, the processor, when processing the log data, converts the accumulated log data into a preset first unit. It is possible to create at least one or more first log data groups by grouping them into .

The processor generates a separation criterion for classifying the plurality of log data, and when processing the log data, divides the accumulated log data according to the separation criterion, and forms partition data in which log levels are matched. , and store the plurality of log data matched with the log level in the database in reverse order of time.

In addition to this, a computer program stored in a computer readable recording medium for execution to implement the present disclosure may be further provided.

In addition to this, a computer readable recording medium recording a computer program for executing a method for implementing the present disclosure may be further provided.

According to the above-mentioned problem solving means of the present disclosure, since log data is stored and managed based on a reverse order of time, when the latest log data that is most frequently viewed is retrieved, a reverse order log data file to be searched through a query is displayed. Since it can be directly accessed, it can provide an effect that the search speed of log data can be improved.

In addition, according to the above-described problem solving means of the present disclosure, since a plurality of log data is grouped and managed, or processed according to a separation criterion and stored in reverse order of time, log data management is more efficient to facilitate search. can do.

The effects of the present disclosure are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the description below.

1 is a block diagram showing the configuration of a log data management system of the present disclosure;
Figure 2 is a flow chart for explaining the log data management method of the present disclosure
3 and 4 are flowcharts for explaining the log data management method of FIG. 2 in more detail.
5 to 9 are exemplary diagrams for explaining the log data management method of the present disclosure.
10 is a flowchart for explaining the log data management method of FIG. 2 in more detail;

Like reference numbers designate like elements throughout this disclosure. The present disclosure does not describe all elements of the embodiments, and general content or overlapping content between the embodiments in the technical field to which the present disclosure belongs is omitted. The term 'unit, module, member, or block' used in the specification may be implemented as software or hardware, and according to embodiments, a plurality of 'units, modules, members, or blocks' may be implemented as one component, It is also possible that one 'part, module, member, block' includes a plurality of components.

Throughout the specification, when a part is said to be "connected" to another part, this includes not only the case of being directly connected but also the case of being indirectly connected, and indirect connection includes being connected through a wireless communication network. do.

In addition, when a certain component is said to "include", this means that it may further include other components without excluding other components unless otherwise stated.

Throughout the specification, when a member is said to be located “on” another member, this includes not only a case where a member is in contact with another member, but also a case where another member exists between the two members.

Terms such as first and second are used to distinguish one component from another, and the components are not limited by the aforementioned terms.

Expressions in the singular number include plural expressions unless the context clearly dictates otherwise.

In each step, the identification code is used for convenience of description, and the identification code does not explain the order of each step, and each step may be performed in a different order from the specified order unless a specific order is clearly described in context. there is.

Hereinafter, the working principle and embodiments of the present disclosure will be described with reference to the accompanying drawings.

In this specification, 'each component in the log data management system including the log data management server according to the present disclosure' includes all various devices capable of providing results to users by performing calculation processing. For example, each component in the log data management system according to the present disclosure may include a computer, a server device, and a portable terminal, or may be in any one form.

Here, the computer may include, for example, a laptop computer, a desktop computer, a laptop computer, a tablet PC, a slate PC, and the like equipped with a web browser.

The server device is a server that processes information by communicating with an external device, and may include an application server, a computing server, a database server, a file server, a game server, a mail server, a proxy server, and a web server.

The portable terminal is, for example, a wireless communication device that ensures portability and mobility, and includes a Personal Communication System (PCS), a Global System for Mobile communications (GSM), a Personal Digital Cellular (PDC), a Personal Handyphone System (PHS), and a PDA. (Personal Digital Assistant), IMT (International Mobile Telecommunication)-2000, CDMA (Code Division Multiple Access)-2000, W-CDMA (W-Code Division Multiple Access), WiBro (Wireless Broadband Internet) terminal, smart phone ) and wearable devices such as watches, rings, bracelets, anklets, necklaces, glasses, contact lenses, or head-mounted-devices (HMDs). can include

1 is a block diagram showing the configuration of a log data management system of the present disclosure.

Referring to FIG. 1 , the log data management system 10 may include a log data management server 100 , a database 200 and a service server 300 .

Upon receiving the log data (logDATA) transmitted from the agent in the user terminal 400, the log data management server 100 may process and store it in the database 200 to store and manage it in reverse chronological order.

The above-described log data (logDATA) refers to data including information on all operations performed while using the content service provided through the service server 300 in the user terminal 400, and can be stored in the form of a file. there is. When the database 200 searches a table mapped with a log data file, it can access the corresponding file and search log data. Such log data can be used for tracking problems that occur during program development or operation, or for monitoring operational status.

When log data is generated, the user terminal 400 may transmit the log data to the log data management server 100 through a network. At this time, the log data may include a log generation time value in the user terminal 400 .

Since analyzing the log data described above on the user terminal 400 is inefficient in terms of resources, in the present disclosure, an agent is installed in the user terminal 400 and log data is transmitted to the log data management server 100 through the agent. is to analyze it.

The log data management server 100 needs to optimize a data search speed through a query in order to analyze the received log data. Accordingly, in order to construct the log data of the present disclosure in a file format optimized for reading rather than in a general database format, the structure of the log data file is processed into a format optimized for log analysis.

Specifically, the log data management server 100 converts the log data into time based on any one of the log generation time on the user terminal 400 and the time when the log data management server 100 receives the log data. You can save in reverse order. The log data may be any one of hot data, warm data, and cold data. At this time, the order of hot data -> warm data -> cold data may be based on the priority of time, and the log data management server 100 searches log data so that log data of hot data can be searched first. that can process data. Then, the log data management server 100 may process the log data so that it can be searched in the order of warm data and cold data.

That is, the time for storing log data in reverse order may be any one of log generation time and log reception time. These items can be set in advance according to the needs of the operator.

The user terminal 400 may be a navigation device, but is not limited thereto, and may be a terminal including an application for providing various content services that generate log data.

The user terminal 400 may include an agent to collect log data generated from the corresponding terminal and transmit the collected log data to the log data management server 100 . If the user terminal 400 is a navigation device, the log data may be various types of information generated in relation to road guidance on the navigation device. In addition, when the user terminal 400 is a wired or wireless terminal and an application providing a ticketing service is installed, the log data may be information related to login for ticketing, date and time selection, seat selection, payment, and the like.

The database 200 may store a plurality of processed log data transmitted from the log data management server 100 in reverse chronological order. As shown in FIG. 1 , the database 200 may include a first database DB1 210 for separately storing and managing a plurality of log data in reverse chronological order. Although not shown, the database 200 may further include a second database that stores and manages data in ascending order of time (ASC) in addition to the first database 210 .

The database 200 may store and manage log data in the form of a mapping table. In this case, the log data may be stored in a table form by matching corresponding times. In the present disclosure, time may be defined as meaning including date and time. In addition, log data may be stored by further matching identification information and the like.

Referring to FIG. 8 , the database 200 may store a plurality of merged log data in preset units under the control of the log data management server 100 . In this case, the preset unit may include at least one of time and the number of log data.

For example, the preset unit is a time standard including per minute, per hour, and per day, or based on the number of log data of 30, 60, and 24, or time and It may be a criterion including the number of log data.

The database 200 may manage the capacity of the database by deleting or compressing a mapping table for log data in a cold state under the control of the log data management server 100 .

As shown in FIG. 1 , the log data management server 100 and the database 200 may be separately implemented, but are not limited thereto and may be implemented together in one configuration.

The service server 300 may access the database 200 to search various data related to provision and management of content services. The service server 300 is a server for providing various services such as navigation service, ticketing service for viewing musicals and concerts, train ticketing service, shopping service for purchasing items such as clothing and food, and university course registration service. can be In this regard, a corresponding application for providing the various services described above may be installed in the user terminal 400 .

The service server 300 of the present disclosure searches log data, but due to the log data storage method in the database 200 of the present disclosure, the most recent log data may be preferentially searched. At this time, the most recent log generation time of log data may be the most recent log reception time of log data.

Referring to FIG. 1 , the log data management server 100 includes a processor 110 , a memory 130 and a communication unit 150 . At this time, the processor 110 may include the loader unit 111, the reverse processing unit 113, and the data processing unit 115 to control the operation of each component. The components shown in FIG. 1 are not essential to implement the log data management server 100 according to the present disclosure, so the log data management server 100 described in this specification has more or more components than those listed above. , or may have fewer components.

The processor 110 may receive a plurality of log data transmitted from the user terminal 400 . At this time, the user terminal 400 may transmit a plurality of log data through an agent.

The processor 110 may accumulate a plurality of log data in reverse order of time.

The processor 110 may process a plurality of log data according to preset standards.

For example, when accumulating a plurality of log data, when a predetermined accumulation time arrives or a predetermined number of log data is accumulated, the processor 110 divides the accumulated plurality of log data into a predetermined first unit. At least one or more first log data groups may be created by grouping.

As another example, the processor 110 generates a separation criterion for classifying a plurality of log data, and when processing the log data, divides the accumulated log data according to the separation criterion to match the log level partition data ( partition data). In this case, the separation criterion may include a time value. That is, the processor 110 does not merge and group a plurality of log data based on a plurality of log data, but separates them according to a separation criterion.

The processor 110 may store a plurality of processed log data in the database 200 in reverse chronological order. In this case, the processor 110 may store the log data in the reverse order of time based on any one of the log generation time and the log reception time.

The processor 110 may store a plurality of log data matched with log levels in the database 200 in reverse chronological order.

A detailed description of the above-described processor 110 will be described in detail with reference to FIGS. 2 to 4 to be described later.

The memory 130 may store a computer program for providing a log data management method, and the stored computer program may be read and driven by the processor 110 . The memory 130 may store any type of information generated or determined by the processor 110 and any type of information received by the communication unit 150 .

The memory 130 may store data supporting various functions of the log data management server 100 and programs for operating the processor 110, and may store input/output data, and the log data management server 100 ), data and commands for the operation of the log data management server 100 can be stored. At least some of these application programs may be downloaded from an external server through wireless communication.

The memory 130 may be a flash memory type, a hard disk type, a solid state disk type, a silicon disk drive type, or a multimedia card micro type. micro type), card-type memory (for example, SD or XD memory, etc.), RAM (Random access memory; RAM), SRAM (Static random access memory), ROM (Read-only memory; ROM), EEPROM (Electrically erasable It may include a storage medium of at least one type of a programmable read-only memory (PROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, and an optical disk. In addition, the memory is separate from the present device, but may be a database connected by wire or wireless.

The communication unit 150 may include one or more components enabling communication with an external device, and for example, at least one of a broadcast reception module, a wired communication module, a wireless communication module, a short-distance communication module, and a location information module. can include

Although not shown, the log data management server 100 of the present disclosure may further include an output unit and an input unit.

The output unit may display a user interface (UI) for providing log data processing results and the like. The output unit may output any type of information generated or determined by the processor 110 and any type of information received by the communication unit 150 .

The output unit includes a liquid crystal display (LCD), a thin film transistor-liquid crystal display (TFT LCD), an organic light-emitting diode (OLED), a flexible display, 3 At least one of 3D displays may be included. Some of these display modules may be of a transparent type or a light transmissive type so that the outside can be seen through them. This may be referred to as a transparent display module, and a representative example of the transparent display module is TOLED (Transparent OLED) and the like.

The input unit may receive information input by a user. The input unit may include keys and/or buttons on a user interface or physical keys and/or buttons for receiving information input by a user. A computer program for controlling a display according to embodiments of the present disclosure may be executed according to a user input through an input unit.

2 is a flowchart illustrating a log data management method of the present disclosure.

A description will be made with reference to FIGS. 5 and 6, which are exemplary diagrams for explaining the log data management method of the present disclosure.

The processor 110 of the log data management server 100 may receive a plurality of log data through the loader unit 111 (1100). The plurality of log data may include at least one of log data initially received from the user terminal 400 and log data pre-stored in the database 200 . At this time, log data of a state initially received from the user terminal 400 may include a log generation time value in the user terminal.

Referring to FIG. 5 , the processor 110 may sequentially receive a plurality of log data L1, L2, L3, L4, etc. over time and store them in the memory 130 in ascending order (ASC).

Next, the processor 110 may accumulate a plurality of log data in reverse order of time through the reverse order processing unit 113 (1200).

In this case, the processor 110 may store the log data in reverse order of time based on any one of the log generation time and the log reception time through the reverse order processing unit 113 .

As shown in FIG. 5 , the processor 110 may arrange a plurality of received log data in a tournament sorting manner so that they may be stored in reverse chronological order. For example, the processor 110 changes the alignment of the plurality of log data from L1 ADDR -> L2 ADDR -> L3 ADDR -> L4 ADDR to the alignment of L4 ADDR -> L3 ADDR -> L2 ADDR -> L1 ADDR to memory memory (130). In this case, the L4 ADDR may be the most recent log generation time of log data or the most recent log reception time of log data.

The processor 110 converts the log data received through the reverse processing unit 113 into time based on any one of the log generation time on the user terminal 400 and the time when the loader unit 111 receives the log data. can be stored in reverse order. That is, the time for storing log data in reverse order may be a log generation time and a log reception time. These items can be set in advance according to the needs of the operator.

Next, the processor 110 may process a plurality of log data according to preset criteria through the data processing unit 115 (1300).

5 and 6 , the processor 110 may form a plurality of log data L1, L2, L3, and L4 into a group of LG1 through the data processing unit 115. This process is repeated, and as shown in FIG. 6, the processor 110 through the data processing unit 115 LG1, LG2, ... LGz, etc. can be generated.

Next, the processor 110 may store a plurality of log data processed through the data processing unit 115 in the database 200 in reverse order of time (1400).

Specifically, the processor 110 can store log data in the database 200 in the reverse order of time based on any one of the log generation time and the log reception time through the data processing unit 115 . The log data may be any one of hot data, warm data, and cold data. At this time, the order of hot data -> warm data -> cold data may be based on the priority of time, and the log data management server 100 searches log data so that log data of hot data can be searched first. that can process data. Then, the log data management server 100 may process the log data so that it can be searched in the order of warm data and cold data.

To this end, a physical address on the database 200 of each of a plurality of log data may be assigned so that the most recent log data can be searched first. Physical address allocation of the log data may be performed by the data processor 115 of the processor 110 or the database 200 .

Referring to FIG. 6 , the processor 110 may store log data in the database 200 in reverse chronological order so that the most recent log data LGz may be preferentially searched through the data processing unit 115 .

That is, when the service server 300 needs to search for log data, the service server 300 searches from Lz within LGz, which is the most recently generated log data.

FIG. 3 is a flowchart illustrating the log data management method of FIG. 2 in more detail, and a case of forming a group using a plurality of log data will be described as an example.

Hereinafter, a description will be made with reference to FIGS. 6 to 8, which are exemplary diagrams for explaining the log data management method of the present disclosure.

In the above-described accumulation step 1200 of FIG. 2 , the processor 110 may check whether accumulation conditions match through the data processing unit 115 .

In this case, the accumulation condition may include whether a preset accumulation time has arrived or whether a preset number of log data has been accumulated. That is, the accumulation condition may include at least one of an accumulation time and the number of log data.

When a preset accumulation time arrives or when a preset number of log data is accumulated and meets the accumulation condition (2100), the processor 110 transfers the plurality of log data accumulated through the data processing unit 115 to a preset number of log data. At least one first log data group may be generated by grouping by 1 unit (eg, 3 seconds) (2200). In this case, a plurality of log data in the first log data group may also be listed in reverse chronological order.

For example, referring to FIG. 6 , the processor 110 may group a plurality of log data L1, L2, L3, and L4 in units of 3 seconds to form a first log data group of LG1. Thereafter, when the accumulation conditions are identical, the processor 110 may form L5, L6, L7, and L8 as a first log data group of LG2. The processor 110 repeats the above process, LG1, LG2, ... First log data groups of LGz may be formed.

Next, the processor 110 may generate a second log data group by grouping at least one or more first log data groups into a second unit through the data processing unit 115 (2300). The second unit may be a criterion including a larger time or a larger number than the first unit. For example, when the first unit is 3 seconds, the second unit may be 30 seconds.

The processor 110 may repeat the above-described process through the data processing unit 115 to generate a large-scale reverse order merge file. For example, the processor 110 via the data processor 115 first unit -> second unit -> ... It is possible to form a reverse order log data group of the Nth unit. In this case, the second unit may have a larger reference value than the first unit, and the Nth unit may have a larger reference value than the previous unit.

Referring to FIG. 7 , the processor 110 merges LG1 and LG2 through the data processor 115 to form a second log data group of LG-A, and merges LG3 and LG4 to form a second log data group of LG-B. Data can be formed into groups.

The second log data groups processed through the above process may be stored in the database 200 in reverse chronological order so that a group composed of a plurality of log data sets based on the most recent one can be searched first. . At this time, the most recent log generation time of log data may be the most recent log reception time of log data.

For example, referring to FIG. 7 , when LG-A and LG-B exist, LG-B that is more recent than LG-A can be stored in the database 200 so that it can be searched with priority.

Meanwhile, referring to FIG. 8 , the processor 110 may control the database 200 through the data processing unit 115 to store a plurality of merged log data in a preset unit. In this case, the preset unit may include at least one of time and the number of log data.

For example, the preset unit is a time standard including per minute, per hour, and per day, or based on the number of log data of 30, 60, and 24, or time and It may be a criterion including the number of log data.

The processor 110 may control to manage the capacity of the database 200 by deleting or compressing a mapping table for log data in a cold state.

On the other hand, in the case of a query to which a filter for log data is applied, the query time may increase because several tables (files) are accessed and the query is performed at the same time.

For example, if you want to search a specific log level among values within a specific time interval (ts), apply a view object, which is a general form used when searching multiple tables (files), to merge related tables (files). Afterwards, data that satisfies a specific log level is retrieved from the entire table (file), so speed may be slowed down. If there is only one log level to be searched for, log data corresponding to that one log level can be obtained after constructing an inline view by UNION ALLing all candidate log data tables within the time period to be searched.

Accordingly, the present disclosure applies a partition table function instead of a view to merge related tables (files) in order to retrieve only the first table among candidate log data tables within the time interval to be searched when the log level to be searched is one. You can manage log data so that you can search data that meets the conditions by accessing it individually without doing so. A detailed description of this will be described later.

FIG. 4 is a flowchart for explaining the log data management method of FIG. 2 in more detail. An example of managing log data in the form of a partition table by separating log data rather than merging them into groups will be described. do.

Hereinafter, it will be described with reference to FIG. 9, which is an exemplary view for explaining the log data management method of the present disclosure.

Prior to the processing step 1300 of FIG. 2 , the processor 110 may generate a separation criterion for classifying a plurality of log data through the data processing unit 115 (3100). In this case, the processor 110 may distinguish a plurality of log data based on time values through the data processing unit 115 .

Specifically, the processor 110 generates a separation criterion to classify log data based on a change in traffic over time through the data processing unit 115 or creates a separation criterion to classify log data based on time. can In this case, the time may be any one of log generation time and log reception time of log data.

The aforementioned change in traffic over time may mean a change in traffic that occurs over time when the service server 300 provides a service. At this time, the processor 110 may classify the curve of change in traffic volume according to the lapse of time through the data processing unit 115 according to a predetermined criterion and set it as a separation criterion.

For example, when the service server 300 provides a ticketing service, changes in traffic volume may occur while performing service procedures such as login, seat selection, and payment. The processor 110, through the data processing unit 115, determines the time when the traffic volume is the highest in a specific time period, the time when the traffic volume is the lowest, the time when the traffic volume rises above a reference value, the traffic volume falls above a reference value, and combinations thereof. It can be set as a separation criterion including at least one of them.

Next, in step 1300 of processing the log data of FIG. 2, the processor 110 divides the plurality of log data accumulated through the data processing unit 115 according to a separation criterion, and converts the log level into a partition data format matching the log level. Can be processed (3200). For example, the log level may include the date and time of log data. As shown in FIG. 9, the log level may be for searching log data.

As another example, the log level may include TRACE, DEBUG, INFO, WARN, ERROR, and FATAL, but is not limited thereto and may be changed according to the operator's needs.

The above TRACE is a more detailed event to solve the problem that the debug level is too broad, DEBUG is a message used for debugging purposes during development, INFO is an informational message such as any state change, and WARN is no problem with program execution, but in the future　Warning messages that can cause system errors, 　ERROR is a state in which a problem has occurred while processing a certain request, and a major problem has occurred in program operation. can mean

Next, in step 1400 of storing the log data of FIG. 2 in the database, the processor 110 stores a plurality of log data matched with log levels through the data processing unit 115 in the database 200 in reverse chronological order. can (3300).

Next, the processor 110 may share the log level by transmitting it to the service server 300 through the data processing unit 115 (3400). After that, as shown in FIG. 9 , the service server 300 may search for log data corresponding to a specific log level.

In Figure 9, LG1, LG2, ... LG may be a unit separated according to a separation criterion. In this case, the service server 300 searches the entire log data stored in reverse order of time based on search priority, LGz -> . . . Instead of searching in the order of -> LG2 -> LG1, you can look up data that meets a specific log level in each separated log data, so you can expect an effect that the search speed can be further increased.

10 is a flowchart for explaining the log data management method of FIG. 2 in more detail, and another example of separating log data will be described.

Prior to the processing step 1300 of FIG. 2, the processor 110 receives a query request for specific log level data requested from the service server 300 through the data processing unit 115 and received through the database 200. can (4100). At this time, the search request for specific log level data may include a time range and log level to be searched.

Next, in step 1300 of processing the log data of FIG. 2, the processor 110 divides the plurality of log data accumulated through the data processing unit 115 based on the date and time, and the partition data matched with the log level. It can be processed into a shape (4200). That is, the processor 110 can classify a plurality of log data into time values. In this case, the log level may include the date and time of log data. The date and time may be a log generation date and time, or a log reception date and time.

The criterion for determining the date and time of the log data is shared with the service server 300 in advance, and the reference time range and log level to be inquired included in the inquiry request for specific log level data transmitted from the service server 300 can also be matched. For example, if the date and time of the log data in the processor 110 is the log generation time (including the date and time), the time within the log level and the time range in the service server 300 is also based on the log generation time. it may have been

Next, in step 1400 of storing the log data of FIG. 2 in the database, the processor 110 stores a plurality of log data matched with log levels through the data processing unit 115 in the database 200 in reverse chronological order. can (4300).

The log data management server 100 may store log data in reverse chronological order based on any one of log generation time and log reception time.

Then, although not shown, the database 200 searches and extracts log data that matches the time range and log level within the search request of specific log level data from the service server 300 and returns it to the service server 300. there is.

On the other hand, the method according to the present disclosure described above may be implemented as a program (or application) to be executed in combination with a server, which is hardware, and stored in a medium.

The disclosed embodiments may be implemented in the form of a recording medium storing instructions executable by a computer. Instructions may be stored in the form of program codes, and when executed by a processor, create program modules to perform operations of the disclosed embodiments. The recording medium may be implemented as a computer-readable recording medium.

Computer-readable recording media include all types of recording media in which instructions that can be decoded by a computer are stored. For example, there may be read only memory (ROM), random access memory (RAM), magnetic tape, magnetic disk, flash memory, optical data storage device, and the like.

As above, the disclosed embodiments have been described with reference to the accompanying drawings. Those skilled in the art to which the present disclosure pertains will understand that the present disclosure may be implemented in a form different from the disclosed embodiments without changing the technical spirit or essential features of the present disclosure. The disclosed embodiments are illustrative and should not be construed as limiting.

10: Log data management system
100: log data management server
110: processor
111: loader unit
113: reverse order processing unit
115: data processing unit
130: memory
150: communication department
200: database
210: first database
300: service server

Claims (10)

In the method performed by the device,
arranging a plurality of received log data in a tournament sorting manner and accumulating in reverse order of log generation time or log reception time;
generating a plurality of first log data groups by grouping the plurality of accumulated log data in a first unit;
dividing the plurality of log data generated as a group based on a separation criterion in which a traffic volume change curve over time is classified according to a predetermined criterion and processing the log data into a form of partition data in which log levels are matched;
assigning physical addresses in a database to store the plurality of log data matched with the processed log levels in reverse chronological order so that the most recent log data can be retrieved first; and
generating a second log data group by grouping the plurality of first log data groups into a second unit;
The separation criterion includes at least one of the time when the traffic volume is the highest, the time when the traffic volume is the lowest, the time when the traffic volume rises above a reference value, the time when the traffic volume falls above a reference value, and a combination thereof, and
The second unit is a criterion including a larger time or a larger number than the first unit, log data management method.
delete delete delete According to claim 1,
After the step of storing the plurality of log data matched with the log level in reverse order of time,
The log data management method further comprising the step of transmitting and sharing, by the device, the log level to a service server.
delete A program stored in a computer readable recording medium in order to execute the log data management method of any one of claims 1 and 5, coupled with a computer.
loader unit;
reverse order processing unit; and
Includes a processor for controlling the operation of the data processing unit;
the processor,
A plurality of received log data is listed in a tournament sorting method and accumulated in the reverse order of log generation or reception time,
generating a plurality of first log data groups by grouping the plurality of accumulated log data in a first unit;
The plurality of log data generated as a group is classified based on a separation criterion in which a curve of traffic volume change over time is classified according to a predetermined criterion and processed into a partition data form in which log levels are matched,
assigning physical addresses in the database so that the most recent log data can be searched first for the plurality of log data matched with the processed log level, and storing them in reverse chronological order; and
Grouping the plurality of first log data groups into a second unit to create a second log data group;
The separation criterion includes at least one of the time when the traffic volume is the highest, the time when the traffic volume is the lowest, the time when the traffic volume rises above a reference value, the time when the traffic volume falls above a reference value, and a combination thereof, and
The second unit is a criterion including a time or a larger number than the first unit, the log data management server. delete delete

Images