KR20090000278A - System for analyzing log and method thereof - Google Patents

Abstract

A log analysis system using log data of a standard log format and log analysis method for the same is provided to operation of the log analysis system automate and analysis log data. An interface part(110) supports communication with one or more device. A printing part displays the log data of the standard log format. If the log data received through the interface part is the standard log format, the log format converting part(120) transmits the log data to the printing part directly or if the log data is the non-standard log format, the log format converting part converts the log data into the standard log format and then transmits it to the printing part. A data evaluating part evaluates casual relation and interaction between each device by using the log data of the standard log format which is received from one or more device. A data transmitting part transmits a result report to a log evaluating system.

Description

System for analyzing log and method Thereof}

1 is a schematic diagram for briefly explaining the operation of a conventional log analysis system.

2 is a block diagram illustrating a configuration of a log analysis system according to an exemplary embodiment.

3 is a diagram illustrating an example of a standard log format in XML format.

4 is a diagram illustrating in detail the configuration of the log analysis system illustrated in FIG. 2.

5 is a diagram illustrating how log data in XML format is displayed on a screen.

6 is a block diagram illustrating a configuration of a log analysis system according to another exemplary embodiment.

7A and 7B are diagrams for describing an operation of an integrated log analysis system based on the log analysis system illustrated in FIG. 6.

8 is a block diagram illustrating a configuration of a log analysis system according to another exemplary embodiment.

9 is a flowchart illustrating a log analysis method according to an embodiment of the present invention.

10 is a flowchart illustrating a log analysis method according to another embodiment of the present invention.

Explanation of symbols on the main parts of the drawing

110, 610, 810: interface unit 120, 620, 820: log format conversion unit

130: output unit 630, 830: data analysis unit

640, 840: data transmission unit 650, 850: log storage unit

860: script analysis unit 870: notification unit

The present invention relates to a log analysis system and a log analysis method thereof, and more particularly, to a log analysis system using the log data of a standard log format and a log analysis method thereof.

As the size of the network grows, the number of systems that make up the network increases, and the amount and content of log data to be analyzed began to increase exponentially. As a result, it is difficult to find and analyze an event having meaning in the log data. Here, the log data refers to data that records input and output information of the system.

1 is a schematic diagram for briefly explaining the operation of a conventional log analysis system.

According to FIG. 1, the log analysis target systems 10 and 14 are connected to the log analysis systems 13 and 16 through communication media lines 11 and 15 suitable for each. The log analysis systems 13 and 16 output or store log data using an application program that can output or store a log on the screen.

In this case, since there is no standardization convention for log data format, each target system is created in a unique log format. The unique log format has a problem in that it is difficult to analyze due to a lack of necessary information and understanding of a specific target system log.

In addition, when a plurality of log analysis systems have a complex interaction, since a separate log is created for each system, there is a problem that it is difficult to find the correlation of the interaction of devices at the time of analysis.

In addition, when a specific situation requiring analysis occurs, it is necessary to stop the system and analyze the log generated by each system, but there is a problem in that it does not provide a function for notifying when a specific situation requiring analysis occurs.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problems, and an object of the present invention is to use log data in a standard log format, thereby quickly and easily analyzing log data, and log analysis capable of automating the operation of a log analysis system. A system and its log analysis method are provided.

According to an embodiment of the present invention for achieving the above object, an interface unit for supporting communication with at least one device, and if the log data received through the interface unit is a non-standard log format, standardize the log data And a log format conversion unit for converting the log format into output.

Preferably, the apparatus further includes an output unit configured to display log data of the standard log format, wherein the log format converter is provided to the output unit as is when the log data received through the interface unit is a standard log format. If the received log data is in a non-standard log format, it is converted to the standard log format and provided to the output unit.

More preferably, when log data in a standard log format is received from the at least one device, a data analyzer for analyzing interactions and causal relationships between the devices using the received log data, the data analyzer The apparatus may further include a data transmission unit for transmitting the result to another log analysis system, and a log storage unit for filtering and storing log data regarding a specific event among the analysis results.

Also, preferably, the log data in the standard log format may be in an extensible markup language (XML) format.

Also preferably, the method may further include a script analyzer configured to extract and analyze the script described in the log data.

In addition, preferably, if a predetermined event occurs during the script analysis, may further include a notification unit for notifying the event occurrence.

Meanwhile, according to an embodiment of the present invention, in the log analysis method of the log analysis system, receiving log data from at least one device, and converting the log data into a standard log format when the log data is a non-standard log format. In the case of the log format, bypassing and outputting log data of the standard log format.

Preferably, analyzing the interaction and causal relationship between each device using the log data of the standard log format received from the at least one device, filtering and storing the log data of a specific event of the analysis results And transmitting the analysis result to the other log analysis system.

More preferably, the log data of the standard log format may be in an extensible markup language (XML) format.

Also preferably, the method may further include extracting and analyzing the script described in the log data.

Also preferably, during the script analysis, the method may further include notifying an event occurrence when a predetermined event occurs.

Hereinafter, with reference to the accompanying drawings will be described in detail with respect to the present invention.

2 is a block diagram illustrating a configuration of a log analysis system according to an exemplary embodiment. According to FIG. 2, the log analysis system 100 includes an interface unit 110 and a log format converter 120.

The interface unit 110 serves to support communication with at least one device. That is, the interface unit 110 may receive log data from a device that is a log analysis target. In detail, the interface unit 110 may be implemented as a terminal capable of supporting a network communication medium such as a LAN or a serial communication medium such as RS-232.

When the log data received through the interface unit 110 is in a non-standard log format, the log format converter 120 converts the received log data into a standard log format and outputs the converted log data. Here, the standard log format may be in an extensible markup language (XML) format in a format determined by an appointment between manufacturers of each device.

Extensible Markup Language is a web page description language standardized by taking advantage of Standard Generalized Markup Language (SGML) to create structured electronic documents. It's designed to make it easy for you to create and manage the content you add. In addition, the user can manipulate the structured database at will, and structurally, the XML documents follow the SGML document format, and thus can be regarded as SGML in application or abbreviated form.

This extensible markup language enables not only standard formatting of log data, but also easy log analysis and processing using a log data parser.

The log format converter 120 converts the log data that does not support the XML format among the log data received through the interface 110 to the XML format. The log format converter 120 may convert log data of a non-standard log format into log data of a standard format by using log format information stored in a database (not shown).

3 is a diagram illustrating an example of a standard log format in XML format. The log format illustrated in FIG. 3 is an example of a log format using XML, and various types of log data may be added or deleted in some cases.

4 is a diagram illustrating in detail the configuration of the log analysis system illustrated in FIG. 2. According to FIG. 4, the log analysis system 100 includes an interface unit 110, a log format converter 120, and an output unit 130. Detailed description of parts overlapping with those of the embodiment shown in FIG. 2 among the elements shown in FIG. 4 will be omitted.

The output unit 130 serves to display log data in a standard log format received through the interface unit 110. If there are a plurality of devices connected to the log analysis system 100, the output unit 130 displays the log data of each device on a single screen according to a predetermined rule so that the user can check / log the log data of the plurality of devices on a single screen. Allow for analysis. Here, a certain rule may be, for example, a temporal order.

5 is a diagram illustrating how log data in XML format is displayed on a screen. The log format illustrated in FIG. 5 is an example of a log format using XML, and various log data may be added or deleted in some cases.

In this case, the log format conversion unit 120 provides the output unit 130 as it is if the log data received through the interface unit 110 is a standard log format, and if the received log data is a non-standard log format. The standard log format may be converted and provided to the output unit 130.

Referring to FIG. 5, a trigger item for executing the trigger module may be defined in the log data.

The trigger module (not shown) is a module for recognizing or controlling an error or a specific situation of a system and defines a situation in which the trigger module operates when the log analysis system 100 is designed, and generates an alert when the trigger module operates. You can execute the batch process.

6 is a block diagram illustrating a configuration of a log analysis system according to another exemplary embodiment. According to FIG. 6, the log analysis system 600 includes an interface unit 610, a log format converter 620, a data analyzer 630, a data transmitter 640, and a log storage unit 650. . Detailed descriptions of parts overlapping with those of FIGS. 2 and 4 of the elements illustrated in FIG. 6 will be omitted.

When log data of a standard log format is received from a plurality of devices, the data analyzer 630 analyzes interactions and causal relationships between the devices using the received log data.

That is, the data analyzer 630 analyzes the interaction and causality between each device using the log data in the XML format by the log data parser (not shown). In particular, since log data of a standard log format received from a plurality of devices can be analyzed in a chronological order, it is possible to easily identify a device that causes an error and to analyze other device operation errors due to a specific device error. . The data analysis unit 630 may integrate / analyze the log data analysis results of each device to create various types of management data.

The data transmitter 640 transmits the results analyzed by the data analyzer 630 to the other log analysis system. Here, the other log analysis system may be an upper log analysis system capable of integrated analysis of management data generated by the plurality of log analysis systems 600.

The log storage unit 650 filters and stores log data regarding a specific event among analysis results. The log storage unit 650 may store log data related to a specific event such as a system error, and may store management data transmitted to another log analysis system through the data transmitter 640.

FIG. 7A is a diagram for describing an operation of an integrated log analysis system based on the log analysis system illustrated in FIG. 6.

As shown in FIG. 7A, devices 715 to 717 that require integrated analysis in cluster # 1 710 are connected to log analysis system 1 711 through communication media 712 to 714, and log analysis is performed. The system 1 711 may receive log data in a standard log format from each of the devices 715 to 717, analyze the log data, and then write management data. The log analysis systems 721 and 731 in the plurality of analysis target clusters 720 and 730 configured in the same manner as the cluster # 1 710 also analyze the upper log through the networks 750 to 770 through management data created through the same task. Transmit to system 741. The cluster # 2 720 and the cluster # 3 730 also have the same configuration as the cluster # 1 710, that is, the device to be analyzed, the log analysis system, and communication media. For reference, the drawings are omitted for clarity.

In this case, the upper log analysis system 741 may integrate and analyze log data of devices in each cluster 710, 720, and 730 by using management data received from each log analysis system 711 to 731. .

FIG. 7B is a diagram for describing an exemplary embodiment of the integrated log analysis system illustrated in FIG. 7A.

As illustrated in FIG. 7B, the devices Device 1 715, Device 2 716, and Device 3 717 that require integrated analysis in the DEMO ROOM 710 communicate with the communication media 712 to Log Analysis System 1 711. 714 is connected. The log analysis system 1 711 receives and analyzes log data 715a, 716a, and 717a in a standard log format from the devices 715 to 717, and then writes the management data 718 in various forms. Can be. In this case, in the case of Device 2 (716) and Device 3 (717), the log data is written in the standard format (716a, 717a) and transmitted to the log analysis system 1 (711), and in the case of Device 1 (715) Since it is written in the non-standard log format 715b, the log format conversion unit 620 of the log analysis system 1 711 is converted into the standard log format 715a. In addition, there are devices 4, 5, and 6 that are devices that require integrated analysis in the QA ROOM 720. Although a detailed illustration of the QA ROOM 720 is omitted, each device is connected to the log analysis system 2 721 through communication media, such as the DEMO ROOM 710, and the log analysis system 2 721 is connected to each device. The management data 728 may be created after receiving and analyzing log data in a standard log format from the system.

The management data 718 and 728 generated in the plurality of analysis target clusters may be analyzed by the upper log analysis system 741 to generate the integrated management data 748. Here, DEMO refers to a test to show the performance of a program or hardware, and QA (Quality Assurance) refers to a task of first playing a device under development and checking its quality.

In the present embodiment, the case in which the analysis target cluster is three (FIG. 7A) or two (FIG. 7B) has been described. However, the number of the analysis target clusters is not limited and may operate in the same manner as in FIGS. 7A and 7B. .

8 is a block diagram illustrating a configuration of a log analysis system according to another exemplary embodiment. According to FIG. 8, the log analysis system 800 includes an interface unit 810, a log format converter 820, a data analyzer 830, a data transmitter 840, a log storage unit 850, and a script analysis. A unit 860 and a notification unit 870 is included. Detailed descriptions of parts overlapping with those of FIGS. 2, 4, and 8 shown in FIG. 8 will be omitted.

The script analyzer 860 extracts and analyzes a script described in log data.

As illustrated in FIG. 5, the script 510 described in the log data in XML format may be extracted and analyzed. A script is an instruction (or program) that is translated or executed by a program other than a computer processor (script engine). For example, JavaScript, vibescript, asp, and the like. Therefore, a script engine is needed to interpret the script code.

For example, the script portion "NotificationTestScript.script" 510 shown in FIG. 5 may be defined to perform the operation shown in the box portion 511, and the script analyzer 860 extracts the script portion. Analyze the role.

The notification unit 870 notifies the event occurrence when a predetermined event occurs during script analysis by the script analysis unit 860. That is, when an event such as an error occurs during script analysis, a warning alarm may be generated or an error message may be displayed in a popup window.

9 is a flowchart illustrating a log analysis method according to an embodiment of the present invention. According to the log analysis method of FIG. 9, when log data is received from at least one device (S910), the received log data is converted to a standard log format when the log data is a non-standard log format, and bypassed when the log data is a standard log format. (S920). Subsequently, log data of a standard log format may be output (S930). Here, the log data of the standard log format is preferably formed in an extensible markup language (XML) format.

10 is a flowchart illustrating a log analysis method according to another embodiment of the present invention. According to the log analysis method of FIG. 10, when log data is received from at least one device (S1010), the received log data is converted to a standard log format when the log data is a non-standard log format, and bypassed when the log data is a standard log format. (S1020). Subsequently, the interaction and causality between the devices are analyzed using log data in a standard log format (S1030).

In operation S1030, the log data of the specific event is filtered and stored (S1040), and the analysis result is transmitted to another log analysis system (S1050).

In addition, during the log data analysis process, the script described in the log data may be extracted and analyzed. If a predetermined event occurs during the script analysis, the event occurrence may be notified.

Accordingly, log data can be analyzed quickly and easily.

As described above, according to the present invention, log analysis of a heterogeneous system can be facilitated by using log data in a standard log format. That is, it is easy to analyze the interaction and causality between devices through information such as log order and delay time outputted by each device through integrated collection / management of standardized log data. In addition, test automation can be performed through log analysis and script support using log data in a standardized format.

In addition, although the preferred embodiment of the present invention has been shown and described above, the present invention is not limited to the specific embodiments described above, but the technical field to which the invention belongs without departing from the spirit of the invention claimed in the claims. Of course, various modifications can be made by those skilled in the art, and these modifications should not be individually understood from the technical spirit or the prospect of the present invention.

Claims (11)

An interface unit supporting communication with at least one device; And, And a log format conversion unit converting the log data into a standard log format and outputting the log data received through the interface unit in a non-standard log format. The method of claim 1, And an output unit configured to display log data in the standard log format. The log format conversion unit, When the log data received through the interface unit is a standard log format, it is provided to the output unit as it is, and when the received log data is a non-standard log format, it is converted to the standard log format and provided to the output unit. Log analysis system. The method according to claim 1 or 2, A data analyzer configured to analyze interactions and causality between devices using the received log data when log data of a standard log format is received from the at least one device; A data transmitter for transmitting the result analyzed by the data analyzer to another log analysis system; And, And a log storage unit for filtering and storing log data regarding a specific event among the analysis results. The method according to claim 1 or 2, And the log data of the standard log format is in an extensible markup language (XML) format. The method of claim 4, wherein And a script analyzing unit configured to extract and analyze the script described in the log data. The method of claim 5, And a notification unit that notifies the event occurrence when a predetermined event occurs during the script analysis. In the log analysis method of the log analysis system, Receiving log data from at least one device; Converting the log data into a standard log format when the log data is in a non-standard log format and bypassing the log data in the standard log format; And, Outputting log data in the standard log format. The method of claim 7, wherein Analyzing interactions and causal relationships between each device using log data in a standard log format received from the at least one device; Filtering and storing log data about a specific event among the analysis results; And, And transmitting the analysis result to another log analysis system. The method according to claim 7 or 8, And the log data of the standard log format is in an extensible markup language (XML) format. The method of claim 9, Extracting and analyzing the script described in the log data; Log analysis method further comprising. The method of claim 10, During the script analysis, if a predetermined event occurs, notifying the fact that the event; log analysis method further comprising a.

Images